lov-video-moments
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes subprocess.run to call ffmpeg and ffprobe for media processing. All commands are executed with list-based arguments, effectively mitigating shell injection risks.
- [INDIRECT_PROMPT_INJECTION]: The photographic processing engine parses external Sony XML sidecar files for color metadata. The script includes a manual check for DTD and entity declarations to prevent XML External Entity (XXE) attacks.
- [CREDENTIALS_UNSAFE]: The profile management tool (profile_store.py) features a safety filter that blocks the storage of sensitive keys such as api_key, token, or password in the user's durable profile.
- [SAFE]: The skill demonstrates high security standards by implementing SHA-256 integrity verification for extracted frames, HTML escaping for output galleries, and atomic file operations for configuration management.
Audit Metadata