cli-anything-shotcut

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several system commands to perform video editing tasks. It relies on melt (MLT CLI) for rendering, ffmpeg and ffprobe for media analysis, and shotcut for project management. These are legitimate uses of command execution within the video editing context.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the cli-anything-shotcut Python package. This package is the core tool described in the skill and is distributed through standard package registries.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media files and project configuration files, creating an attack surface for indirect prompt injection.
  • Ingestion points: Commands such as media import <file> and open <path> ingest external files (SKILL.md).
  • Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious content within these files.
  • Capability inventory: The skill can perform file system writes and execute subprocesses through the render and probe commands (SKILL.md).
  • Sanitization: No sanitization or validation of external media metadata or project XML is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:21 PM
Security Audit — agent-trust-hub — cli-anything-shotcut