media-moviepy
Warn
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Instructions in SKILL.md and references/moviepy.md direct the user to use sudo for installing system packages and modifying sensitive configuration files (e.g., sudo sed -i ... /etc/ImageMagick-6/policy.xml). This is recommended to enable specific functionality but represents a privilege escalation pattern.
- [COMMAND_EXECUTION]: The bundled script scripts/moviepy_cli.py uses the subprocess module to execute shell commands, specifically for running generated Python code and interacting with system binaries.
- [REMOTE_CODE_EXECUTION]: The script scripts/moviepy_cli.py dynamically constructs Python source code as strings using data from command-line arguments and external JSON templates. This generated code is then executed using the current Python interpreter (sys.executable -c). While the script employs sanitization via repr(), dynamic code generation and execution is a high-risk pattern.
Audit Metadata