Skills
skills/jeremylongshore/claude-code-plugins-plus-skills/deepgram-performance-tuning/Gen Agent Trust Hub

deepgram-performance-tuning

Warn

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The preprocessAudio function in SKILL.md uses execSync to call ffmpeg by interpolating inputPath and outputPath directly into a shell command string. This pattern is vulnerable to command injection if the file paths are derived from untrusted user input without strict validation or escaping.
  • [EXTERNAL_DOWNLOADS]: The skill relies on and provides implementation for several third-party libraries including @deepgram/sdk, fluent-ffmpeg, p-limit, ioredis, and prom-client to handle API communication, audio manipulation, concurrency, caching, and monitoring.
  • [SAFE]: The skill correctly handles sensitive credentials, such as DEEPGRAM_API_KEY and REDIS_URL, by accessing them through environment variables rather than hardcoding them in the scripts.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 7, 2026, 04:56 PM