subtitles

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.check_output across several scripts (burn.py, extract.py, _mediaskills_common.py) to interface with ffmpeg and ffprobe for media processing.
  • Evidence includes structured command lists passed to subprocess.run (e.g., ['ffmpeg', '-y', '-i', str(path), '-map', '0:s:0', str(out)] in extract.py).
  • Command arguments are strictly controlled by the scripts' logic and validated input paths, minimizing risks of shell injection.
  • [SAFE]: The external dependencies (Pillow, ffmpeg, ffprobe) are industry-standard tools for the described use cases.
  • The burn.py script uses uv run to manage the Pillow dependency safely.
  • The implementation uses safe practices such as tempfile.TemporaryDirectory() for intermediate frames during video overlay rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 12:21 PM
Security Audit — agent-trust-hub — subtitles