broll-actor-copy
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
ffmpegandffprobefor video trimming, scaling, and muting operations. These commands are executed viasubprocess.runusing list-based arguments, which is a best practice that mitigates the risk of shell command injection. Evidence found inscripts/_common.pyfunctionsffprobe_video,mute_clip,concat_clips, andprepare_video. - [EXTERNAL_DOWNLOADS]: The skill interacts with the Replicate API to perform motion transfer and downloads the resulting video files using
urllib.request.urlretrieve. It also implements a token discovery mechanism that looks for Replicate API keys in environment variables, local configuration, or designated sibling skill directories within the user's home environment (~/.cursor/skills/). This behavior is consistent with the intended functionality and orchestration of the agent platform. - [DYNAMIC_EXECUTION]: A dynamic import using
__import__is present inscripts/_common.py. This is used as a runtime check to verify the installation of thereplicatepackage and provide helpful installation instructions if it is missing, rather than to execute untrusted or remote code.
Audit Metadata