typed-ffmpeg-usage

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides installation instructions for the typed-ffmpeg and typed-ffmpeg-compatible Python packages from PyPI. These are standard packages provided by the skill author.
  • [COMMAND_EXECUTION]: The skill demonstrates the use of the typed-ffmpeg library to execute FFmpeg and ffprobe commands on the system.
  • [COMMAND_EXECUTION]: A code example in the 'Media File Analysis' section uses the eval() function on the r_frame_rate property returned by ffprobe.
  • Ingestion points: Data is ingested from external media files via the ffmpeg.probe() function as shown in SKILL.md.
  • Boundary markers: None provided in the code example; it treats the external metadata string as trusted code.
  • Capability inventory: The skill provides capabilities for arbitrary command execution via stream.run() and direct Python code execution via eval().
  • Sanitization: No sanitization is performed on the r_frame_rate string before it is passed to eval(). While typically a string like '30/1', a maliciously crafted media file could theoretically provide a payload that executes arbitrary Python code when processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 07:13 PM
Security Audit — agent-trust-hub — typed-ffmpeg-usage