offload-r2

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes several standard CLI tools, including git for version control, bun for script execution, curl for network requests, and rg (ripgrep) for searching references within the codebase.
  • [EXTERNAL_DOWNLOADS]: Downloads are performed from https://remotion.media/ (the author's domain) using curl. This is used exclusively to fetch the uploaded object's bytes for hash comparison to ensure data integrity during the migration process.
  • [REMOTE_CODE_EXECUTION]: An automated scanner alert for piped-to-shell execution was identified as a false positive. The instruction curl ... | shasum was misinterpreted as curl ... | sh (shell execution). The command correctly pipes the download stream into a hashing utility, not an interpreter.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 08:55 AM