paw-cra-video-longform
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external media tools to perform video validation and assembly.
- Evidence:
scripts/validate-video.pyusessubprocess.runto callffprobeandffmpegfor metadata extraction and loudness measurement. - Evidence:
references/assembly-guide.mdprovidesffmpegcommand templates for concatenating scenes and mixing audio. - Context: All programmatic command executions in the provided scripts use list-based arguments rather than shell strings, which effectively mitigates shell injection risks.
- [EXTERNAL_DOWNLOADS]: The production pipeline involves interacting with external AI and stock footage providers.
- Evidence:
references/scene-generation.mdandreferences/voiceover-generation.mddocument usage offal.ai,elevenlabs.io, andapi.pexels.comAPIs. - Context: These are well-known technology services necessary for the skill's primary purpose of video and audio synthesis. The skill uses standard authentication headers and documentation for these services.
- [SAFE]: The skill handles sensitive information like API keys using appropriate configuration patterns.
- Evidence:
SKILL.mdinstructs the agent to load keys from{project-root}/.pawbytes/config/config.yamlrather than hardcoding them. - Context: This follows standard secret management practices for developer tools.
Audit Metadata