media-subtitle-sync
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external binaries (
alass,ffsubsync,ffmpeg,ffprobe) using Python'ssubprocess.runinscripts/subsync.py. These calls are implemented using argument lists without the shell=True flag, which is a secure practice to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The documentation suggests installing
ffsubsyncviapipandalassvia Homebrew or from the official GitHub releases of the tool's author (kaegi/alass). These are well-known resources in the media processing community and are consistent with the skill's primary purpose.
Audit Metadata