shorts-from-takes

Warn

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: In scripts/build.py, the skill utilizes sys.path.insert and dynamic imports within the get_loudnorm function to load external audio normalization logic. The path used for this import can be supplied via the video_use_helpers field in the specification file or is automatically searched for in the user's home directory. This allows for the execution of arbitrary code from outside the skill's own package based on the environment and configuration.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to clone an external GitHub repository (github.com/browser-use/video-use) to perform transcription and other helper tasks. This creates a dependency on code from an external source that is not verified as part of the skill itself.
  • [COMMAND_EXECUTION]: The skill frequently invokes ffmpeg and ffprobe using the subprocess module to analyze and process video segments. These calls use parameters derived from the spec.json input, such as file paths and start/end times. While the implementation uses list-based arguments to avoid shell injection, it constitutes a significant surface for command execution based on external input.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 28, 2026, 12:56 PM