Skills
skills/gooseworks-ai/goose-skills/review-ugc-render/Gen Agent Trust Hub

review-ugc-render

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/review_render.py executes ffmpeg, curl, and whisper using subprocess.run. All calls utilize the secure list-based argument format, which mitigates shell injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill transmits audio data to transcription APIs (OpenAI or a vendor-specific proxy) via curl. This is the intended functionality for audio-to-text conversion.
  • [CREDENTIALS_UNSAFE]: The skill retrieves configuration and authentication tokens from ~/.gooseworks/credentials.json. This is standard behavior for the gooseworks-ai toolset and is used to authenticate with the transcription proxy.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 09:42 AM
Security Audit — agent-trust-hub — review-ugc-render