footage-cutlist
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts
survey.py,cut.py, and_common.pyexecuteffmpegandffprobecommands to extract metadata, frames, and render video content. The implementation utilizessubprocess.runandsubprocess.Popenwith list-based arguments, effectively mitigating risks of shell injection. - [EXTERNAL_DOWNLOADS]: The
_common.pyscript attempts to locate standard system fonts and falls back to downloading a Roboto font from Google's public GitHub repository if local candidates are missing. This resource is fetched from a well-known, trusted source. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined
cutlist.jsonconfigurations and media files. To handle this attack surface,cutlist.pyprovides validation for paths, data types, and logical constraints such as non-overlapping timing and valid video durations.
Audit Metadata