lov-video-moments
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto executeffmpegandffprobefor video indexing, frame extraction, and color correction. These calls use a list of arguments and avoidshell=True, which is a secure implementation. The command parameters (like video paths and adjustment values) are strictly validated and typed. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (video files and Sony XML sidecars). It mitigates injection risks by: 1) Manually scanning XML sidecars for DTD/Entity declarations to prevent XXE attacks; 2) Using
html.escapewhen generating thegallery.htmlsummary to prevent cross-site scripting (XSS); 3) Requiring human-in-the-loop visual review for all generated images before final packaging. - [CREDENTIALS_UNSAFE]: The
profile_store.pyscript includes a defensive filter (SENSITIVE_PARTS) that prevents storing secret-like fields (tokens, passwords, API keys) in the skill's durable records, following security best practices for local state management.
Audit Metadata