video-merger
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes
ffmpegandffprobeas subprocesses to perform video processing. These operations are conducted using list-based arguments insubprocess.runand do not utilizeshell=True, effectively preventing command injection vulnerabilities. The use of these tools is consistent with the skill's declared purpose. - [EXTERNAL_DOWNLOADS]: The skill includes installation scripts (
install.shandinstall.ps1) that download theffmpegbinary. These scripts use well-known and trusted package management systems, includingapt,Homebrew,winget,Chocolatey, andScoop. These are standard methods for managing system-level dependencies. - [DATA_EXFILTRATION]: No patterns associated with data exfiltration or unauthorized network communication were detected. The skill's file system operations are limited to reading input videos and writing the merged output as intended.
Audit Metadata