audio-to-subtitles
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes scripts using
npx -y bun, which is a standard execution pattern for Node.js-based tools. - [COMMAND_EXECUTION]: The skill uses
npxandbunto execute its own local scripts as demonstrated in the documentation. This is part of its core functionality for processing media files. - [DATA_EXFILTRATION]: The skill uploads local audio/video files to Cloudflare R2 to provide a public URL for the transcription API. This is a documented and necessary step for the Volcengine AI MediaKit ASR service, which requires public URLs. The credentials for R2 are managed via environment variables.
- [CREDENTIALS_UNSAFE]: The skill requires API keys for MiniMax, Volcengine, and Cloudflare R2. The implementation correctly retrieves these from environment variables or a local
.envfile and does not hardcode any secrets.
Audit Metadata