livestream-clips-v2
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses "child_process.spawnSync" to invoke system tools including "ffmpeg", "ffprobe", "python", and "node". These operations are central to its function of processing video files and performing speech-to-text transcription.
- [DYNAMIC_EXECUTION]: The scripts "generate-captions.js" and "transcribe-raw.js" generate temporary Python scripts at runtime to interface with the "faster-whisper" library. The generated code uses static templates and does not execute arbitrary external input.
- [EXTERNAL_DOWNLOADS]: Documentation instructs users to install standard dependencies such as "Node.js", "FFmpeg", "faster-whisper" (via pip), and project-specific packages (via npm). The "faster-whisper" library automatically downloads model weights from Hugging Face during its first run, which is standard behavior for this well-known tool.
- [DATA_EXPOSURE]: The skill processes local video files and generates metadata files in the "starter/tmp/" and "starter/source-clips/" directories. No access to sensitive user credentials or unauthorized network exfiltration was detected.
- [INDIRECT_PROMPT_INJECTION]: The skill processes transcripts generated from video audio. While this presents a theoretical surface for indirect prompt injection, the risk is minimal as the AI is primarily instructed to perform structured editing tasks rather than interpreting transcript content as command logic.
Audit Metadata