create-imessage-video-ad

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of ffmpeg to process video and audio. These commands are executed via execSync in Node.js templates (record-master.template.js, render-end-card.template.js) and subprocess.run in Python helper scripts within Bash templates (stitch.template.sh). All executions are directed at local file processing and are consistent with the skill's primary purpose.
  • [EXTERNAL_DOWNLOADS]: The fal_helpers.py script includes functionality to download generated assets from the FAL.ai service using standard Python libraries. This is used for generating photographic backgrounds or end-card assets as specified in the workflow.
  • [DYNAMIC_EXECUTION]: The skill uses dynamic execution patterns for automation. For example, record-master.template.js injects a driver script into a Playwright browser context to control message timing. Additionally, stitch.template.sh executes an inline Python script via a heredoc to calculate audio offsets and build complex ffmpeg filter chains.
  • [CREDENTIALS_UNSAFE]: The skill properly handles API keys for the FAL.ai service. The load_fal_key() function in fal_helpers.py retrieves secrets from environment variables or .env files rather than using hardcoded values, which aligns with security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 12:54 PM
Security Audit — agent-trust-hub — create-imessage-video-ad