video-merger

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes ffmpeg and ffprobe as subprocesses to perform video processing. These operations are conducted using list-based arguments in subprocess.run and do not utilize shell=True, effectively preventing command injection vulnerabilities. The use of these tools is consistent with the skill's declared purpose.
  • [EXTERNAL_DOWNLOADS]: The skill includes installation scripts (install.sh and install.ps1) that download the ffmpeg binary. These scripts use well-known and trusted package management systems, including apt, Homebrew, winget, Chocolatey, and Scoop. These are standard methods for managing system-level dependencies.
  • [DATA_EXFILTRATION]: No patterns associated with data exfiltration or unauthorized network communication were detected. The skill's file system operations are limited to reading input videos and writing the merged output as intended.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 09:26 AM
Security Audit — agent-trust-hub — video-merger