ra-audio-to-subtitles
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes
ffmpegandffprobeusing thesubprocess.runmethod to extract audio streams and calculate media duration. These operations use list-based arguments without a shell, which effectively prevents command injection attacks.\n- [EXTERNAL_DOWNLOADS]: The script transmits audio data to the Volcengine ASR API atopenspeech.bytedance.comfor transcription. This is the primary function of the skill and targets a well-known service provider.\n- [CREDENTIALS_UNSAFE]: The skill accesses sensitive API keys by parsing local.envfiles in the workspace. This is a standard and recommended practice for secret management in development environments, avoiding hardcoded credentials in the source code.
Audit Metadata