wjs-editing-multicam

Pass

Audited by Gen Agent Trust Hub on May 30, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to execute ffmpeg commands for audio extraction (autoedit.py) and video rendering (render_cuts.py, render_pip.py). These operations are the core functionality of the skill and are implemented using argument lists rather than shell strings, which effectively mitigates shell injection risks. The static analysis flags for these calls are considered false positives given the implementation context.
  • [SAFE]: Analysis of the Python scripts confirms that no network operations, data exfiltration, or obfuscation techniques are employed. The skill processes local video files and JSON configuration files (EDLs) as intended for its stated purpose.
  • [SAFE]: Input handling for external data, such as .sync.json sidecar files, includes appropriate type casting (e.g., converting JSON values to float), which prevents untrusted data from influencing the program logic in unexpected ways.
Audit Metadata
Risk Level
SAFE
Analyzed
May 30, 2026, 12:47 AM
Security Audit — agent-trust-hub — wjs-editing-multicam