davinci-resolve-pro-edit

Warn

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The setup.sh script automates the installation of numerous Python packages including computer vision and audio processing libraries (e.g., mediapipe, onnxruntime-gpu) and NVIDIA CUDA runtime components.\n- [REMOTE_CODE_EXECUTION]: Scripts such as render_gfx.sh and matte_gpu.py execute npx --yes hyperframes, which pulls and runs a CLI tool from the npm registry during the rendering process.\n- [DYNAMIC_EXECUTION]: scripts/build_gfx.py uses __import__ to load graphics configuration modules dynamically based on filenames matching scripts/gfx_*.py.\n- [COMMAND_EXECUTION]: Extensive orchestration of CLI tools like ffmpeg and npx occurs through subprocess.Popen and subprocess.run. The matte_gpu.py script specifically utilizes shell=True for execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an indirect injection surface as it processes transcript data (ingestion points in transcript.txt and listing.txt) derived from untrusted audio sources. This data is used to plan editing beats and generate publishing metadata without explicit sanitization, and the skill possesses significant write and execute capabilities (capability inventory in media.py and other processing scripts).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 5, 2026, 12:00 PM