audiocut-keyword
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to executeffmpegandffprobefor audio duration detection, segment extraction, and final clipping. All command invocations use list-based arguments rather than shell strings, which effectively prevents command injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The transcription logic relies on the
FunASRlibrary, which fetches pre-trained models (e.g.,paraformer-zh) from the Alibaba ModelScope repository. This is standard behavior for machine learning tools and utilizes a well-known, established service. - [COMMAND_EXECUTION]: The main script supports an optional integration with a separate
voice-changerskill. It executes the external script usingsubprocess.runwith list arguments, ensuring that user-supplied parameters for the voice type are not interpreted as shell commands.
Audit Metadata