cursor-rig
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/build_rig.pyutilizes thesubprocessmodule to executeffmpegfor extracting frames from user-provided video clips.\n - Evidence: Call to
subprocess.runwithffmpegarguments inscripts/build_rig.py.\n - The command is constructed using an argument list, which is a secure practice that prevents shell-injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill documentation specifies common, well-known Python dependencies available from official package registries.\n
- Evidence: Instructions to
pip install numpy opencv-python-headlessinSKILL.md.\n - No non-standard or untrusted external resources are fetched at runtime.\n- [DATA_EXFILTRATION]: No sensitive file access or network-based data exfiltration patterns were observed in the code.\n
- The Python script exclusively processes local media assets and utilizes the system's temporary directory for intermediate steps.\n- [PROMPT_INJECTION]: The
SKILL.mdcontains descriptive templates for generating image and video assets.\n - Evidence: Prompt blocks in
SKILL.mddescribing character head turns and camera settings.\n - These are intended to guide the user and do not contain instructions aimed at subverting AI safety constraints or overriding system prompts.
Audit Metadata