recap-video

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/assemble.py script executes system commands via subprocess.run to call ffmpeg and ffprobe. These operations are used for media analysis, silent segment detection, and final video rendering. The script passes arguments as lists, which is a recommended security practice to prevent shell injection vulnerabilities.
  • [COMMAND_EXECUTION]: The scripts/smoke-test.py utility performs automated regression tests by invoking ffmpeg and the primary assembly script. These executions are contained within a temporary directory environment and are used to verify the integrity of the video assembly logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, such as transcripts and edit decision lists (transcript.json, edl-lines.json), which could contain malicious instructions. However, the logic in scripts/assemble.py treats these inputs strictly as data for calculating timestamps and metadata, and does not execute or evaluate the content as code or prompt instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 05:24 PM