render-with-profile

Warn

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands for video processing by interpolating values from local configuration files.
  • Evidence: In Step 3, the skill uses jq to extract values such as encoder, resolution, and extra_args from render-profiles.json. These values are then concatenated into an ffmpeg command string in Step 5.
  • Risk: If the render-profiles.json file (which is created or modified by other processes) contains malicious shell metacharacters like semicolons, backticks, or pipes, it could lead to arbitrary command execution when the agent runs the resulting script.
  • [SAFE]: The skill restricts its tool usage to a specific set of utilities (ffmpeg, ffprobe, jq, etc.) and operates within standard user data directories (~/.local/share/claude-plugins/video-editing), which is consistent with its stated purpose.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 13, 2026, 03:34 PM
Security Audit — agent-trust-hub — render-with-profile