wjs-segmenting-video
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Multiple Python scripts, including
segment.py,burn_subs.py,prepend_intro.py, andmake_cover.py, utilize thesubprocessmodule to invoke external binaries such asffmpeg,ffprobe, andnode. These operations are essential for the primary functionality of video cutting, metadata extraction, and cover generation.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided SRT transcript files to determine video segment boundaries. Maliciously crafted content within these transcripts could potentially influence the agent's behavior during the topic identification and segmentation process.\n - Ingestion points: The agent reads
source_srtfiles (e.g.,input.zh-CN.srt) to decide topical boundaries.\n - Boundary markers: Structural instructions are provided in
SKILL.mdto "snap to SRT cue boundaries," and specific JSON schemas are used for output.\n - Capability inventory: The skill can write files, execute shell commands through
ffmpeg, and invoke other local skills.\n - Sanitization: No explicit sanitization or filtering of transcript content is implemented before processing.\n- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the setup of a virtual environment to install well-known Python packages (
mediapipe,opencv-python,numpy) from PyPI. Additionally,burn_subs.pycontains a link to a third-party site (evermeet.cx) in a docstring as a recommended source for FFmpeg binaries.\n- [DYNAMIC_EXECUTION]: Themake_cover.pyscript executes a local Node.js script located at a hardcoded path (~/.claude/skills/gpt-image-2-skill/scripts/gpt_image_2_skill.cjs). This is a dynamic execution of a local dependency required for image generation.
Audit Metadata