video-to-text

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/douyin_extract.py uses subprocess.run to invoke curl for fetching video metadata via Server-Side Rendering (SSR) pages. This is a common pattern for scraping metadata from dynamic websites like Douyin without requiring browser automation.
  • [COMMAND_EXECUTION]: The script scripts/vtt.py executes system utilities avconvert (on macOS) or ffmpeg (on Linux) to extract audio from video files before transcription. These are standard media processing tools.
  • [EXTERNAL_DOWNLOADS]: The skill uses pip to install faster-whisper, a well-known machine learning library for speech-to-text. It also downloads the 'tiny' Whisper model (~75MB) from official sources upon first use, which is documented and expected behavior for this type of application.
  • [DATA_EXPOSURE]: The script scripts/douyin_extract.py reads a user-provided environment variable DOUYIN_COOKIE to facilitate authenticated API requests if the SSR method fails. This follows best practices for secret management by not hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 12:58 PM
Security Audit — agent-trust-hub — video-to-text