davinci-resolve-pro-edit
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
setup.shscript automates the installation of numerous Python packages including computer vision and audio processing libraries (e.g.,mediapipe,onnxruntime-gpu) and NVIDIA CUDA runtime components.\n- [REMOTE_CODE_EXECUTION]: Scripts such asrender_gfx.shandmatte_gpu.pyexecutenpx --yes hyperframes, which pulls and runs a CLI tool from the npm registry during the rendering process.\n- [DYNAMIC_EXECUTION]:scripts/build_gfx.pyuses__import__to load graphics configuration modules dynamically based on filenames matchingscripts/gfx_*.py.\n- [COMMAND_EXECUTION]: Extensive orchestration of CLI tools likeffmpegandnpxoccurs throughsubprocess.Popenandsubprocess.run. Thematte_gpu.pyscript specifically utilizesshell=Truefor execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an indirect injection surface as it processes transcript data (ingestion points intranscript.txtandlisting.txt) derived from untrusted audio sources. This data is used to plan editing beats and generate publishing metadata without explicit sanitization, and the skill possesses significant write and execute capabilities (capability inventory inmedia.pyand other processing scripts).
Audit Metadata