laohan-sucai

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses spawnSync in scripts/sucai.mjs to execute ffmpeg and ffprobe for processing video assets.
  • The commands are used to probe video metadata (width, height, duration) and generate thumbnails for human verification.
  • Input paths are generated by the script using a safeName function to prevent shell injection, and arguments are passed as arrays to avoid shell interpretation issues.
  • [EXTERNAL_DOWNLOADS]: The skill downloads video assets from well-known stock services: Pexels, Pixabay, and Coverr.
  • These are official API integrations (e.g., api.pexels.com, pixabay.com/api, api.coverr.co).
  • The skill requires API keys to be provided via environment variables or a local .env file, which is explicitly excluded from version control in the documentation.
  • Downloaded files are hashed (SHA-256) to ensure integrity and consistency during the verification workflow.
  • [SAFE]: The skill implements a robust verification workflow (visually_verified) that prevents automated propagation of external data without human review.
  • It includes a must_not_imply check to ensure stock assets are not misused to represent facts.
  • Local library access is restricted to user-defined paths via the --local-library flag or environment variables.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 02:22 AM
Security Audit — agent-trust-hub — laohan-sucai