style-edit
Fail
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to orchestrate a wide range of external tools for video and audio processing, includingffmpeg,ffprobe,git, and the GitHub CLI (gh). - These tools are used for tasks like probing media files, joining video chunks, managing git repositories, and triggering cloud workflows.
- [DYNAMIC_EXECUTION]: Dynamic Python code is generated and executed as part of the video processing pipeline.
- In
scripts/edit.pyandscripts/modal_render.py, a multiline Python script defined in aJOINconstant is passed topython -cfor final video assembly. scripts/modal_render.pyutilizes the Modal framework to serialize and execute local logic on remote cloud containers.- [REMOTE_CODE_EXECUTION]: The skill offloads computationally intensive rendering and processing tasks to cloud environments.
- It triggers GitHub Actions workflows and Modal function calls to perform parallel video rendering.
- Machine learning models for face detection and background matting are downloaded from external sources at runtime.
- [EXTERNAL_DOWNLOADS]: The skill fetches assets, models, and configuration from various external services.
scripts/capture.mjsfetches icons and site logos from Simple Icons, jsDelivr, and Google APIs.scripts/source.pyusesyt-dlpto retrieve video sections and metadata from YouTube.- The skill automatically manages the installation of the Remotion renderer and Node.js dependencies.
- [DATA_EXFILTRATION]: Local media files and project metadata are transmitted to external services for cloud processing.
- Video footage is uploaded to user-controlled GitHub repositories and Modal Volumes for rendering.
- [CREDENTIALS_UNSAFE]: The skill manages and utilizes third-party API keys and cloud credentials.
- It retrieves secrets from
~/.aws/credentials,~/.modal.toml, and.envfiles to authenticate sessions with ElevenLabs, AWS, and Modal.
Recommendations
- HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata