qiaomu-cut

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill manages the installation of necessary system dependencies including ffmpeg-full via Homebrew and specialized CLI tools such as @marswave/listenhub-cli and @marswave/coli via npm. It also supports downloading media assets from remote URLs during the production process.
  • [COMMAND_EXECUTION]: The skill executes various system binaries to process media, including ffmpeg and ffprobe for video/audio manipulation and say for macOS-based narration. It also executes specialized adapters to interface with third-party AI services. All process executions use list-based arguments to prevent shell injection vulnerabilities.
  • [DATA_EXFILTRATION]: To facilitate integration with local creative tools, the skill reads configuration data from the 33TaiCi application directory (located in ~/Library/Application Support/33TaiCi/) to verify local login status. It proactively redacts sensitive fields like API keys, tokens, and credentials from all stdout/stderr output using a dedicated redaction engine to prevent accidental exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 12:32 AM
Security Audit — agent-trust-hub — qiaomu-cut