subtitles
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandsubprocess.check_outputacross several scripts (burn.py,extract.py,_mediaskills_common.py) to interface withffmpegandffprobefor media processing. - Evidence includes structured command lists passed to
subprocess.run(e.g.,['ffmpeg', '-y', '-i', str(path), '-map', '0:s:0', str(out)]inextract.py). - Command arguments are strictly controlled by the scripts' logic and validated input paths, minimizing risks of shell injection.
- [SAFE]: The external dependencies (Pillow, ffmpeg, ffprobe) are industry-standard tools for the described use cases.
- The
burn.pyscript usesuv runto manage the Pillow dependency safely. - The implementation uses safe practices such as
tempfile.TemporaryDirectory()for intermediate frames during video overlay rendering.
Audit Metadata