cursor-rig

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/build_rig.py utilizes the subprocess module to execute ffmpeg for extracting frames from user-provided video clips.\n
  • Evidence: Call to subprocess.run with ffmpeg arguments in scripts/build_rig.py.\n
  • The command is constructed using an argument list, which is a secure practice that prevents shell-injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill documentation specifies common, well-known Python dependencies available from official package registries.\n
  • Evidence: Instructions to pip install numpy opencv-python-headless in SKILL.md.\n
  • No non-standard or untrusted external resources are fetched at runtime.\n- [DATA_EXFILTRATION]: No sensitive file access or network-based data exfiltration patterns were observed in the code.\n
  • The Python script exclusively processes local media assets and utilizes the system's temporary directory for intermediate steps.\n- [PROMPT_INJECTION]: The SKILL.md contains descriptive templates for generating image and video assets.\n
  • Evidence: Prompt blocks in SKILL.md describing character head turns and camera settings.\n
  • These are intended to guide the user and do not contain instructions aimed at subverting AI safety constraints or overriding system prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 01:54 PM