assembly-and-delivery
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/concat.pyutilizessubprocess.runto invokeffmpegandffprobefor video metadata extraction and concatenation. - Evidence: Subprocess calls in
scripts/concat.pyuse list-based argument passing instead of shell execution strings. - Mitigation: The implementation correctly avoids
shell=True, which protects against common shell injection vulnerabilities. - [SAFE]: The skill's primary focus is local video manipulation. It does not perform network operations, access sensitive credentials, or attempt to persist across sessions.
- The manual handling of temporary files for the FFmpeg concat demuxer follows standard procedures and includes proper cleanup using
os.unlink(). - Path handling within the script uses absolute paths and provides basic escaping for special characters in filenames.
Audit Metadata