broll-actor-copy

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes ffmpeg and ffprobe for video trimming, scaling, and muting operations. These commands are executed via subprocess.run using list-based arguments, which is a best practice that mitigates the risk of shell command injection. Evidence found in scripts/_common.py functions ffprobe_video, mute_clip, concat_clips, and prepare_video.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the Replicate API to perform motion transfer and downloads the resulting video files using urllib.request.urlretrieve. It also implements a token discovery mechanism that looks for Replicate API keys in environment variables, local configuration, or designated sibling skill directories within the user's home environment (~/.cursor/skills/). This behavior is consistent with the intended functionality and orchestration of the agent platform.
  • [DYNAMIC_EXECUTION]: A dynamic import using __import__ is present in scripts/_common.py. This is used as a runtime check to verify the installation of the replicate package and provide helpful installation instructions if it is missing, rather than to execute untrusted or remote code.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 07:08 PM