colorize
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/colorize.pyuses thesubprocessmodule to interact withffmpeg,ffprobe, andsips. These calls are used for legitimate media processing tasks such as probing file metadata, extracting video frames, and encoding the final MP4 output. The commands are constructed using argument lists, which is a secure practice to prevent shell injection. - [DYNAMIC_EXECUTION]: The skill utilizes the
moderngllibrary to compile and execute GLSL shaders (GRAD,MOTION,ROTATE,GLOW) on the GPU at runtime. This is standard behavior for OpenGL-based rendering applications. The shader source code is statically defined within the Python script and does not incorporate untrusted external data. - [INDIRECT_PROMPT_INJECTION]: The skill processes external media files (images, videos, Live Photos) provided by the user. While it ingests untrusted data, the processing is limited to pixel manipulation and metadata extraction. The skill does not pass unsanitized strings from these files back to the LLM's instruction context, mitigating the risk of indirect prompt injection.
Audit Metadata