audio-mix-maker

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The entry point script scripts/run.py utilizes os.execv for process replacement. This is used to ensure the skill executes within a specific virtual environment (.runners-venv) by dynamically calculating the path to the Python interpreter based on the script's own location. This is a common and safe pattern for local dependency management in Python CLI tools.
  • [COMMAND_EXECUTION]: The skill's primary function is to execute ffmpeg commands on the local system. The documentation details various filter chains for mixing audio (replace, overlay, duck), all of which are executed as subprocesses.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential attack surface for indirect prompt injection as it processes user-provided file paths for video and audio inputs.
  • Ingestion points: The --video, --audio, and --output arguments in SKILL.md accept external file paths.
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat these paths as literal strings rather than commands.
  • Capability inventory: The skill has the capability to execute shell commands via ffmpeg as managed by the internal common.runners.cli.mix module.
  • Sanitization: While the implementation of the mix module is not provided, the documentation indicates it is a pure-ffmpeg utility, implying path interpolation into shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 12:50 PM