footage-cutlist

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts survey.py, cut.py, and _common.py execute ffmpeg and ffprobe commands to extract metadata, frames, and render video content. The implementation utilizes subprocess.run and subprocess.Popen with list-based arguments, effectively mitigating risks of shell injection.
  • [EXTERNAL_DOWNLOADS]: The _common.py script attempts to locate standard system fonts and falls back to downloading a Roboto font from Google's public GitHub repository if local candidates are missing. This resource is fetched from a well-known, trusted source.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined cutlist.json configurations and media files. To handle this attack surface, cutlist.py provides validation for paths, data types, and logical constraints such as non-overlapping timing and valid video durations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 05:01 PM