video-recap

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The orchestrator scripts (doctor.py, recap_runner.py, final_qc.py) utilize subprocess.run to invoke system media utilities like ffmpeg and ffprobe and to launch sub-skill scripts. The implementations use list-based arguments without spawning shells, which minimizes command injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with api.xiaomimimo.com and api.fish.audio to process video data and generate text-to-speech. These are the intended service providers for the skill's functionality.
  • [CREDENTIALS_SAFE]: The skill contains defensive code to prevent credential leakage. Scripts such as materials.py and qc_contract.py implement regex-based redaction and JSON key filtering to ensure that API keys (e.g., MiMo, Fish Audio, GitHub, AWS) are masked before being written to persistent storage in the material library or QC reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:52 AM
Security Audit — agent-trust-hub — video-recap