video-recap
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The orchestrator scripts (
doctor.py,recap_runner.py,final_qc.py) utilizesubprocess.runto invoke system media utilities likeffmpegandffprobeand to launch sub-skill scripts. The implementations use list-based arguments without spawning shells, which minimizes command injection risks. - [EXTERNAL_DOWNLOADS]: The skill communicates with
api.xiaomimimo.comandapi.fish.audioto process video data and generate text-to-speech. These are the intended service providers for the skill's functionality. - [CREDENTIALS_SAFE]: The skill contains defensive code to prevent credential leakage. Scripts such as
materials.pyandqc_contract.pyimplement regex-based redaction and JSON key filtering to ensure that API keys (e.g., MiMo, Fish Audio, GitHub, AWS) are masked before being written to persistent storage in the material library or QC reports.
Audit Metadata