video-cut

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill invokes ffmpeg and ffprobe for media processing. All shell commands are constructed as lists of arguments and executed via subprocess.run without a shell, effectively mitigating command injection risks. The skill generates a temporary filter script for complex ffmpeg operations, which is a standard and safe practice for long filtergraphs.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads and writes files within the designated work directory and source paths provided in the input contract. Access is limited to files necessary for the video processing workflow, and no external network communication or credential access was found.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests agent-generated data (clip plans and narration). It treats this content strictly as data; text inputs are stored in output JSON metadata or used for logging, and are not interpolated into shell commands or used to drive critical logic. Ingestion points are structured JSON files, and capabilities are limited to validated ffmpeg operations.
  • [SAFE]: No malicious obfuscation, credential harvesting, unauthorized persistence mechanisms, or remote code downloads were detected. The skill's behavior aligns exactly with its stated purpose of video editing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:53 AM
Security Audit — agent-trust-hub — video-cut