motion-video
Warn
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The file
references/shotcraft-bridge.mdexplicitly instructs the agent to clone an external GitHub repository (https://github.com/Vincentwei1021/video-shotcraft) into the local environment (~/.claude/skills/video-shotcraft). This source is not from a trusted organization or well-known service. - [REMOTE_CODE_EXECUTION]: The skill encourages the agent to navigate into the cloned external repository and execute its content, including running a local Python web server (
python3 -m http.server 4178) and using asset 'cards' that require reading and adapting third-party code implementations at runtime. - [COMMAND_EXECUTION]: The provided scripts
scripts/render-formats.mjsandscripts/stitch.mjsuse Node.jsexecFileSyncto programmatically invoke powerful system utilities includingffmpeg,ffprobe, and the Remotion CLI vianpx. These tools have broad access to the file system and compute resources.
Audit Metadata