laohan-sucai
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
spawnSyncinscripts/sucai.mjsto executeffmpegandffprobefor processing video assets. - The commands are used to probe video metadata (width, height, duration) and generate thumbnails for human verification.
- Input paths are generated by the script using a
safeNamefunction to prevent shell injection, and arguments are passed as arrays to avoid shell interpretation issues. - [EXTERNAL_DOWNLOADS]: The skill downloads video assets from well-known stock services: Pexels, Pixabay, and Coverr.
- These are official API integrations (e.g.,
api.pexels.com,pixabay.com/api,api.coverr.co). - The skill requires API keys to be provided via environment variables or a local
.envfile, which is explicitly excluded from version control in the documentation. - Downloaded files are hashed (SHA-256) to ensure integrity and consistency during the verification workflow.
- [SAFE]: The skill implements a robust verification workflow (
visually_verified) that prevents automated propagation of external data without human review. - It includes a
must_not_implycheck to ensure stock assets are not misused to represent facts. - Local library access is restricted to user-defined paths via the
--local-libraryflag or environment variables.
Audit Metadata