skills/ooiyeefei/ccc/motion-video/Gen Agent Trust Hub

motion-video

Warn

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The file references/shotcraft-bridge.md explicitly instructs the agent to clone an external GitHub repository (https://github.com/Vincentwei1021/video-shotcraft) into the local environment (~/.claude/skills/video-shotcraft). This source is not from a trusted organization or well-known service.
  • [REMOTE_CODE_EXECUTION]: The skill encourages the agent to navigate into the cloned external repository and execute its content, including running a local Python web server (python3 -m http.server 4178) and using asset 'cards' that require reading and adapting third-party code implementations at runtime.
  • [COMMAND_EXECUTION]: The provided scripts scripts/render-formats.mjs and scripts/stitch.mjs use Node.js execFileSync to programmatically invoke powerful system utilities including ffmpeg, ffprobe, and the Remotion CLI via npx. These tools have broad access to the file system and compute resources.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 9, 2026, 11:45 AM
Security Audit — agent-trust-hub — motion-video