wjs-burning-subtitles
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/render.pydownloads a zip file containing an executable FFmpeg binary from an external URL if the local system version lacks libass support. It extracts the binary to a temporary location, sets executable permissions, and runs it to perform video processing tasks. - [EXTERNAL_DOWNLOADS]: The skill downloads a static FFmpeg build from
https://evermeet.cx/ffmpeg/getrelease/zip. Evermeet is a well-known and established provider of FFmpeg binaries for the macOS community, and this download is used to ensure the availability of necessary video filters. - [COMMAND_EXECUTION]: The Python script invokes FFmpeg using
subprocess.run(). The command is passed as a list of strings without invoking a shell, which is a secure implementation that prevents command injection from user-supplied file paths or parameters.
Audit Metadata