stitch-videos-ffmpeg

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes ffmpeg and ffprobe for media processing tasks using the Python subprocess.run method. Arguments are passed as lists rather than strings, which is a standard security practice that mitigates shell injection risks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled media specifications and subtitle data as part of its core functionality.
  • Ingestion points: Media Edit Decision Lists (JSON) and subtitle files (SRT or JSON) are loaded and parsed in scripts/montage.py and scripts/composite.py.
  • Boundary markers: Not present; the data is treated as structured media metadata for processing.
  • Capability inventory: The skill spawns local media processing tasks via the host's FFmpeg installation.
  • Sanitization: The skill validates numeric inputs for timing and layout (e.g., using parse_time and _num helpers), effectively restricting the input surface to valid media parameters.
  • [DYNAMIC_EXECUTION]: The scripts dynamically construct complex FFmpeg filter strings (such as filter_complex) at runtime to apply transitions, panning, and audio ducking. This dynamic generation is scoped to the media processing domain and is a necessary feature for programmatic video editing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 05:19 PM