inspect
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandsubprocess.check_outputto execute theffprobebinary for metadata extraction. These commands are constructed using argument lists rather than shell strings, which effectively prevents shell injection vulnerabilities. - [DATA_EXPOSURE]: The scripts access local media files to retrieve metadata such as duration, resolution, and codec information. The access is restricted to file paths explicitly provided via command-line arguments, and the resulting data is returned as structured JSON to the agent without external exfiltration.
- [REMOTE_CODE_EXECUTION]: All scripts are designed to run locally using the
uvPython runner. They do not download or execute code from remote sources.
Audit Metadata