video-cut
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates video editing by executing
ffmpegandffprobecommands via thesubprocess.runmodule. These commands are invoked using argument lists rather than shell strings, which effectively prevents common shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input data from
clip_plan.jsonandsources_manifestfiles. It employs a mandatory validation process including schema checks, type verification (e.g., duration parsing), and geometric constraints to ensure the input data conforms to expected formats before processing. - Ingestion points:
clip_plan.json,sources_manifestfile, andvideopath argument. - Boundary markers: The skill validates the structure and content of the JSON input files against specific schemas.
- Capability inventory: File system read/write access, and execution of video processing tools (
ffmpeg,ffprobe). - Sanitization: Implements strict type checking, range validation for numeric inputs, and uses path objects for file handling.
- [DYNAMIC_EXECUTION]: Complex
ffmpegfiltergraphs are generated at runtime based on the segments defined in the clip plan. This dynamic generation follows strict templates and is used solely for the intended purpose of concatenating and processing video segments.
Audit Metadata