klap-generate-shorts
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script uses subprocess.run to trigger system-level notifications on macOS (via osascript), Linux (via notify-send), and Windows (via powershell). These commands are used solely to provide user feedback on the status of video processing tasks.
- [EXTERNAL_DOWNLOADS]: The skill downloads processed MP4 files from Klap's storage infrastructure (Google Cloud Storage) based on URLs provided by the Klap API. It implements filename sanitization using an alphanumeric filter to ensure local file paths are safe and valid.
- [SAFE]: Secret management for the Klap API key and database connection string is handled correctly through environment variables and .env file loading, avoiding hardcoded credentials in the source code.
Audit Metadata