clip

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes FFmpeg via node:child_process.execFile to perform video cutting and reframing. This method is secure as it avoids spawning a shell, reducing the risk of command injection. Additionally, clip titles and output paths are sanitized using a strict regular expression to prevent directory traversal or shell meta-character exploitation.
  • [EXTERNAL_DOWNLOADS]: The worker downloads video assets and project metadata from portal-media.perso.ai and perso.ai. These are the vendor's own domains and are necessary for the skill's primary function of processing STT (Speech-to-Text) projects.
  • [CREDENTIALS_SAFE]: The skill manages authentication through environment variables such as XP_API_KEY. It contains explicit instructions and architectural safeguards (like the resolve_key script) to ensure that raw keys are never exposed to the AI model or written to logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 09:23 AM
Security Audit — agent-trust-hub — clip