net-new-video-editor
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/net_new_video_editor.pyinvokesffmpegandffprobefor media analysis and rendering. These calls use the subprocess module with list-based arguments, effectively preventing shell injection. - [SAFE]: Path security is maintained by a dedicated
inside()helper function that resolves and validates all file paths against the project root, preventing directory traversal vulnerabilities. - [SAFE]: Caption rendering is handled through the Pillow library, which rasterizes text into images before compositing with FFmpeg. This avoids the security risks associated with passing user-provided text directly into complex FFmpeg filters.
- [SAFE]: The skill enforces strict type validation for numerical parameters (dimensions, timestamps, audio levels) extracted from JSON plans, ensuring they are valid numbers before processing.
- [COMMAND_EXECUTION]: The
SKILL.mdcontains preamble instructions to execute optional telemetry scripts if they exist in a parent environment. While these files are not bundled with the skill, the execution pattern is handled gracefully and does not introduce a vulnerability in the skill's own code.
Audit Metadata