media-use
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches media assets from remote URLs. It includes a robust validation mechanism to prevent SSRF by blocking requests to local or private networks and enforces a 256MB size limit to prevent disk exhaustion.
- [COMMAND_EXECUTION]: Various scripts execute local binaries such as
ffmpeg,ffprobe, and service-specific CLIs (heygen,codex,mflux-generate). These executions utilize argument arrays rather than raw shell strings, preventing command injection vulnerabilities. - [DATA_EXFILTRATION]: Usage telemetry is sent to a PostHog instance. The implementation ensures that only non-sensitive metadata (media type, source, provider) is transmitted, and it respects standard opt-out environment variables like
DO_NOT_TRACKorHYPERFRAMES_NO_TELEMETRY. - [DYNAMIC_EXECUTION]: The background music generation logic dynamically constructs and executes Python scripts. Security is maintained by using
JSON.stringifyto escape variable content before embedding it into script templates, preventing code injection.
Audit Metadata