minimax-h3-video
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/h3-max-runner.mjsscript utilizesnode:child_process.spawnto execute system commands includingffprobe(for duration validation) andffmpeg(for extracting continuity tails from video files). - The commands are executed with arguments passed as an array, which prevents shell-injection vulnerabilities.
- The operations are scoped to media processing within the production workspace.
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and live route guides from
fal.ai(a well-known AI model hosting service). - It downloads generated video files from
fal.ai's CDN and official queue endpoints (queue.fal.run). - These network operations are intended for the skill's primary purpose and target official, well-known service domains.
- [CREDENTIALS_SAFE]: The skill follows secure practices for secret management by instructing the agent to use environment variables (
SECRET_FAL_KEY,FAL_AI_KEY, etc.) rather than hardcoding credentials or storing them in JSON configuration files.
Audit Metadata