media-matte
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The driver script
scripts/matte.pyutilizessubprocess.runto invoke external command-line utilities. - Evidence: The script executes
rembg,ffmpeg, and the RVMinference.pyscript to perform background removal and video compositing. Commands are passed as lists of arguments, and shell execution is avoided to prevent injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill references external code and assets from well-known services.
- Evidence: Instructions in
SKILL.mdrecommend cloning theRobustVideoMattingrepository from GitHub and installing several machine learning packages from PyPI usinguvorpip. - Evidence: The skill downloads model weights and configuration files from HuggingFace repositories.
- [REMOTE_CODE_EXECUTION]: The skill utilizes a model loading mechanism that allows for remote code execution from a well-known service.
- Evidence: The Python inference logic for the
briaai/RMBG-2.0andZhengPeng7/BiRefNetmodels uses thetrust_remote_code=Trueparameter within the HuggingFacetransformerslibrary. This is used to execute model-specific segmentation logic provided by the model authors. - Evidence: The driver script contains embedded Python snippets (
BIREFNET_INLINE,REFINE_INLINE,COMPOSITE_INLINE) that are executed viapython -c. These snippets are static and facilitate modular inference without imposing full ML dependencies on the primary driver.
Audit Metadata