audio-mix-maker
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The entry point script
scripts/run.pyutilizesos.execvfor process replacement. This is used to ensure the skill executes within a specific virtual environment (.runners-venv) by dynamically calculating the path to the Python interpreter based on the script's own location. This is a common and safe pattern for local dependency management in Python CLI tools. - [COMMAND_EXECUTION]: The skill's primary function is to execute
ffmpegcommands on the local system. The documentation details various filter chains for mixing audio (replace, overlay, duck), all of which are executed as subprocesses. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential attack surface for indirect prompt injection as it processes user-provided file paths for video and audio inputs.
- Ingestion points: The
--video,--audio, and--outputarguments inSKILL.mdaccept external file paths. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat these paths as literal strings rather than commands.
- Capability inventory: The skill has the capability to execute shell commands via
ffmpegas managed by the internalcommon.runners.cli.mixmodule. - Sanitization: While the implementation of the
mixmodule is not provided, the documentation indicates it is a pure-ffmpeg utility, implying path interpolation into shell commands.
Audit Metadata