media-use
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates media processing by invoking several command-line utilities.
- Leverages
ffmpegandffprobefor media analysis, transcoding, and complex editing operations like cutting and ducking. - Interfaces with the
heygenCLI to access vendor-provided services for voice synthesis, video generation, and asset searches. - Utilizes the
codexCLI and various local AI runners (e.g.,mflux,ltx-2-mlx) for on-device generation tasks. - Commands are executed using safe methods like
execFileSyncto mitigate the risk of shell injection from user-provided inputs. - [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of assets and software components from trusted external sources.
- Fetches music, sound effects, and images from HeyGen's official CDN and API endpoints.
- Resolves brand logos by querying well-known services and repositories including
svgl.app, Simple Icons onjsdelivr.net, and GitHub avatar APIs. - AI model weights and related artifacts are downloaded from Hugging Face, a standard platform for hosting machine learning models.
- [REMOTE_CODE_EXECUTION]: Automated dependency management is performed to support local generation capabilities.
- The background music engine includes functionality to automatically install necessary Python libraries such as
google-genaiandtransformersviapip. - All automated installations target reputable packages on the Python Package Index (PyPI) and are strictly limited to the skill's media processing requirements.
Audit Metadata