video-cut

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses ffmpeg and ffprobe to perform video editing tasks. Commands are executed via subprocess.run using argument lists, which prevents shell injection vulnerabilities. The logic handles complex filter graphs by writing them to a temporary file (edit_filter_complex.txt) rather than passing them as raw shell arguments.
  • [DATA_EXFILTRATION]: The skill's operations are confined to the local file system. It reads input video files and JSON metadata (clip_plan.json, narration.json) and writes outputs (edited_source.mp4, clip_plan_validated.json) to a specified working directory. No network exfiltration or unauthorized file access was detected.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data that may be influenced by external content (e.g., clip reasons or narration text).
  • Ingestion points: clip_plan.json, narration.json, and speech_boundary_anchors.json in the work_dir.
  • Boundary markers: None explicitly used in the prompt interpolation.
  • Capability inventory: File system write access, execution of ffmpeg and ffprobe binaries.
  • Sanitization: Input values for time offsets are strictly validated and cast to floats. Source paths and metadata are treated as literal data for the rendering process.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 11:39 AM
Security Audit — agent-trust-hub — video-cut