wjs-segmenting-video

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Multiple Python scripts, including segment.py, burn_subs.py, prepend_intro.py, and make_cover.py, utilize the subprocess module to invoke external binaries such as ffmpeg, ffprobe, and node. These operations are essential for the primary functionality of video cutting, metadata extraction, and cover generation.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided SRT transcript files to determine video segment boundaries. Maliciously crafted content within these transcripts could potentially influence the agent's behavior during the topic identification and segmentation process.\n
  • Ingestion points: The agent reads source_srt files (e.g., input.zh-CN.srt) to decide topical boundaries.\n
  • Boundary markers: Structural instructions are provided in SKILL.md to "snap to SRT cue boundaries," and specific JSON schemas are used for output.\n
  • Capability inventory: The skill can write files, execute shell commands through ffmpeg, and invoke other local skills.\n
  • Sanitization: No explicit sanitization or filtering of transcript content is implemented before processing.\n- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the setup of a virtual environment to install well-known Python packages (mediapipe, opencv-python, numpy) from PyPI. Additionally, burn_subs.py contains a link to a third-party site (evermeet.cx) in a docstring as a recommended source for FFmpeg binaries.\n- [DYNAMIC_EXECUTION]: The make_cover.py script executes a local Node.js script located at a hardcoded path (~/.claude/skills/gpt-image-2-skill/scripts/gpt_image_2_skill.cjs). This is a dynamic execution of a local dependency required for image generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 07:14 AM