shorts-from-takes
Warn
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: In
scripts/build.py, the skill utilizessys.path.insertand dynamic imports within theget_loudnormfunction to load external audio normalization logic. The path used for this import can be supplied via thevideo_use_helpersfield in the specification file or is automatically searched for in the user's home directory. This allows for the execution of arbitrary code from outside the skill's own package based on the environment and configuration. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions to clone an external GitHub repository (
github.com/browser-use/video-use) to perform transcription and other helper tasks. This creates a dependency on code from an external source that is not verified as part of the skill itself. - [COMMAND_EXECUTION]: The skill frequently invokes
ffmpegandffprobeusing thesubprocessmodule to analyze and process video segments. These calls use parameters derived from thespec.jsoninput, such as file paths and start/end times. While the implementation uses list-based arguments to avoid shell injection, it constitutes a significant surface for command execution based on external input.
Audit Metadata