inspect

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.check_output to execute the ffprobe binary for metadata extraction. These commands are constructed using argument lists rather than shell strings, which effectively prevents shell injection vulnerabilities.
  • [DATA_EXPOSURE]: The scripts access local media files to retrieve metadata such as duration, resolution, and codec information. The access is restricted to file paths explicitly provided via command-line arguments, and the resulting data is returned as structured JSON to the agent without external exfiltration.
  • [REMOTE_CODE_EXECUTION]: All scripts are designed to run locally using the uv Python runner. They do not download or execute code from remote sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 02:52 AM
Security Audit — agent-trust-hub — inspect