media-use

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates media processing by invoking several command-line utilities.
  • Leverages ffmpeg and ffprobe for media analysis, transcoding, and complex editing operations like cutting and ducking.
  • Interfaces with the heygen CLI to access vendor-provided services for voice synthesis, video generation, and asset searches.
  • Utilizes the codex CLI and various local AI runners (e.g., mflux, ltx-2-mlx) for on-device generation tasks.
  • Commands are executed using safe methods like execFileSync to mitigate the risk of shell injection from user-provided inputs.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of assets and software components from trusted external sources.
  • Fetches music, sound effects, and images from HeyGen's official CDN and API endpoints.
  • Resolves brand logos by querying well-known services and repositories including svgl.app, Simple Icons on jsdelivr.net, and GitHub avatar APIs.
  • AI model weights and related artifacts are downloaded from Hugging Face, a standard platform for hosting machine learning models.
  • [REMOTE_CODE_EXECUTION]: Automated dependency management is performed to support local generation capabilities.
  • The background music engine includes functionality to automatically install necessary Python libraries such as google-genai and transformers via pip.
  • All automated installations target reputable packages on the Python Package Index (PyPI) and are strictly limited to the skill's media processing requirements.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 02:56 AM
Security Audit — agent-trust-hub — media-use