skills/vibe-motion/colorize/colorize/Gen Agent Trust Hub

colorize

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/colorize.py uses the subprocess module to interact with ffmpeg, ffprobe, and sips. These calls are used for legitimate media processing tasks such as probing file metadata, extracting video frames, and encoding the final MP4 output. The commands are constructed using argument lists, which is a secure practice to prevent shell injection.
  • [DYNAMIC_EXECUTION]: The skill utilizes the moderngl library to compile and execute GLSL shaders (GRAD, MOTION, ROTATE, GLOW) on the GPU at runtime. This is standard behavior for OpenGL-based rendering applications. The shader source code is statically defined within the Python script and does not incorporate untrusted external data.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external media files (images, videos, Live Photos) provided by the user. While it ingests untrusted data, the processing is limited to pixel manipulation and metadata extraction. The skill does not pass unsanitized strings from these files back to the LLM's instruction context, mitigating the risk of indirect prompt injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 01:45 PM