cli-anything-shotcut
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several system commands to perform video editing tasks. It relies on
melt(MLT CLI) for rendering,ffmpegandffprobefor media analysis, andshotcutfor project management. These are legitimate uses of command execution within the video editing context. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
cli-anything-shotcutPython package. This package is the core tool described in the skill and is distributed through standard package registries. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media files and project configuration files, creating an attack surface for indirect prompt injection.
- Ingestion points: Commands such as
media import <file>andopen <path>ingest external files (SKILL.md). - Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious content within these files.
- Capability inventory: The skill can perform file system writes and execute subprocesses through the
renderandprobecommands (SKILL.md). - Sanitization: No sanitization or validation of external media metadata or project XML is described.
Audit Metadata