talking-head-image-overlays
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The Python script
measure-face-band.pyexecutes system tools includingffmpegandswiftcviasubprocess.run. These calls use list-based arguments rather than shell strings, which is a secure practice that prevents command injection. The commands are used for legitimate video frame extraction and compilation of the skill's internal face-detection tool. - [DYNAMIC_EXECUTION]: On macOS, the skill performs runtime compilation of its included Swift source file (
face-landmarks.swift). This is done locally to leverage Apple's Vision framework for face tracking. Since the source is part of the skill package and not fetched from an untrusted remote source, this is considered a safe local build step. - [EXTERNAL_DOWNLOADS]: The skill documentation identifies dependencies on standard, well-known libraries and tools such as
numpy,pillow,ffmpeg, and thehyperframestoolchain. These are standard requirements for video processing tasks and do not involve suspicious or unauthorized remote code execution.
Audit Metadata