clip
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes FFmpeg via
node:child_process.execFileto perform video cutting and reframing. This method is secure as it avoids spawning a shell, reducing the risk of command injection. Additionally, clip titles and output paths are sanitized using a strict regular expression to prevent directory traversal or shell meta-character exploitation. - [EXTERNAL_DOWNLOADS]: The worker downloads video assets and project metadata from
portal-media.perso.aiandperso.ai. These are the vendor's own domains and are necessary for the skill's primary function of processing STT (Speech-to-Text) projects. - [CREDENTIALS_SAFE]: The skill manages authentication through environment variables such as
XP_API_KEY. It contains explicit instructions and architectural safeguards (like theresolve_keyscript) to ensure that raw keys are never exposed to the AI model or written to logs.
Audit Metadata