render-with-profile
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands for video processing by interpolating values from local configuration files.
- Evidence: In Step 3, the skill uses
jqto extract values such asencoder,resolution, andextra_argsfromrender-profiles.json. These values are then concatenated into anffmpegcommand string in Step 5. - Risk: If the
render-profiles.jsonfile (which is created or modified by other processes) contains malicious shell metacharacters like semicolons, backticks, or pipes, it could lead to arbitrary command execution when the agent runs the resulting script. - [SAFE]: The skill restricts its tool usage to a specific set of utilities (ffmpeg, ffprobe, jq, etc.) and operates within standard user data directories (
~/.local/share/claude-plugins/video-editing), which is consistent with its stated purpose.
Audit Metadata