reel-editor
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Multiple scripts, including
cut.py,render.sh, anddoctor.sh, execute shell commands to orchestrate video editing. This involves invokingffmpegfor video manipulation,nodefor timeline calculations, andnpxfor executing platform-specific rendering tools. - [DYNAMIC_EXECUTION]: The
capcut_draft.pyscript performs dynamic module loading by modifyingsys.pathbased on the user-providedCAPCUT_SKILLS_DIRenvironment variable. This enables optional integration with external CapCut helper scripts provided by the user. - [EXTERNAL_DOWNLOADS]: The skill fetches the
gsaplibrary from a public CDN, verifying its integrity with a SHA-256 checksum. It also usesnpxto retrieve thehyperframespackage from theheygen-comorganization. These dependencies are standard for the skill's animation and rendering pipeline. - [DATA_EXFILTRATION]: The skill reads an ElevenLabs API key from a local configuration file (
~/.config/reels/.env) and transmits audio data to ElevenLabs' API for transcription. This behavior is documented and necessary for high-quality caption synchronization.
Audit Metadata