talking-head-remotion

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The Python scaffolding script (scaffold_talking_head_remotion_project.py) uses subprocess.check_output to invoke ffprobe. This is used legitimately to detect the duration of input media files during project setup.
  • [COMMAND_EXECUTION]: The skill includes a shell script (mix_bgm.sh) that utilizes ffmpeg for audio processing tasks, specifically for mixing background music with voiceovers using sidechain compression.
  • [EXTERNAL_DOWNLOADS]: The project documentation and configuration reference assets from reputable external sources, including Google Fonts and Mixkit for sound effects. These are well-known services for media assets and do not pose a security risk in this context.
  • [SAFE]: The skill performs local file operations (copying assets into the project directory) and generates configuration files based on user input. These behaviors are essential for its purpose as a project generator and do not exhibit malicious patterns like data exfiltration or persistence.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 12:54 AM
Security Audit — agent-trust-hub — talking-head-remotion