lov-media-creator
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Python
subprocessmodule across several scripts (e.g.,audio_qc.py,media_probe.py,subtitle_gate.py) to execute external binaries includingffmpegandffprobe. These tools are used for essential media processing tasks such as stream inspection, transcoding, and audio loudness measurement. - [EXTERNAL_DOWNLOADS]: As part of the 'pip-research' workflow described in
references/pip-research.md, the skill automates browser sessions to capture screenshots of third-party websites. This involves fetching content from external, untrusted URLs based on product names detected in the video subtitles. - [SAFE]: The skill implements a secure profile management system in
scripts/profile_store.py. It includes a hardcoded blacklist (SENSITIVE_PARTS) that prevents the storage of sensitive information such as 'token', 'secret', 'password', 'credential', and 'api_key' in the user's persistent profile files. - [SAFE]: Instructions within the skill and its documentation (e.g.,
references/user-profile.md) explicitly state that source code must remain portable and must not contain hardcoded absolute paths or credentials.
Audit Metadata