offload-r2
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several standard CLI tools, including
gitfor version control,bunfor script execution,curlfor network requests, andrg(ripgrep) for searching references within the codebase. - [EXTERNAL_DOWNLOADS]: Downloads are performed from
https://remotion.media/(the author's domain) usingcurl. This is used exclusively to fetch the uploaded object's bytes for hash comparison to ensure data integrity during the migration process. - [REMOTE_CODE_EXECUTION]: An automated scanner alert for piped-to-shell execution was identified as a false positive. The instruction
curl ... | shasumwas misinterpreted ascurl ... | sh(shell execution). The command correctly pipes the download stream into a hashing utility, not an interpreter.
Audit Metadata