Skills
Navigate
skills/liangdabiao/video-skills-toolkit/paper-cutout-remotion/Gen Agent Trust Hub

paper-cutout-remotion

Fail

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/lib_apiz.py executes the apiz command-line interface using subprocess.run to handle image and speech generation tasks. Similarly, scripts/gen_tts.py executes ffprobe to validate and measure the duration of downloaded audio files.
  • [EXTERNAL_DOWNLOADS]: The skill performs automated downloads of image and audio assets from apiz.ai and api.minimaxi.com during the asset generation phase of the video production pipeline.
  • [DATA_EXFILTRATION]: The upload and transfer functions in scripts/lib_apiz.py enable the transmission of local files to the apiz CDN. While required for certain image editing workflows, this feature facilitates outbound data transfer to a third-party service.
  • [CREDENTIALS_UNSAFE]: The function find_minimax_key in scripts/gen_tts.py programmatically scans the filesystem (current and parent directories) for .env files to extract the minimaxi API key.
  • [REMOTE_CODE_EXECUTION]: Automated security scans detected a risk where media files downloaded from api.minimaxi.com are immediately processed by a local subprocess (ffprobe) in scripts/gen_tts.py, a pattern that can lead to remote code execution if the downloaded content is maliciously crafted.
Recommendations
  • HIGH: Downloads and executes remote code from: https://api.minimaxi.com/v1/t2a_v2, unknown (check file) - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 30, 2026, 12:54 AM
Security Audit — agent-trust-hub — paper-cutout-remotion