burn-subtitles
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
ffmpeg,ffprobe,jq, and Whisper backends (whisper.cpp,faster-whisper) to process video files, extract audio, and generate transcriptions. - [PROMPT_INJECTION]: The skill processes untrusted external data in the form of video files and SRT subtitle files. To mitigate risks, it implements sanitization by escaping backslashes, single quotes, and colons when passing the subtitle file path to the ffmpeg filtergraph.
- [DYNAMIC_EXECUTION]: Executable paths for the Whisper backend and Python virtual environment are resolved dynamically from a local configuration file (
preferences.json) located in the user's data directory.
Audit Metadata