Scan Report
5 /100
ffmpeg_multimedia_editing
使用 FFmpeg 进行多媒体编辑，包括视频剪辑、拼接、转码、特效、截图、水印、变速、音频处理等 20 种操作
Legitimate FFmpeg wrapper skill with no malicious indicators - subprocess calls to ffmpeg/ffprobe are the declared core functionality, all processing is local, no network access or credential harvesting.
Safe to install
This skill is safe to use. It performs exactly as documented - local multimedia processing using FFmpeg binaries.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | WRITE | WRITE | ✓ Aligned | SKILL.md declares file write capability; code writes processed media to outputs/… |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md declares ffmpeg/ffprobe as required binaries; common.py line 168: subpr… |
| Network | NONE | NONE | — | No network requests found in codebase |
| Environment | READ | READ | ✓ Aligned | Only reads OUTPUT_ROOT environment variable for output directory |
File Tree
23 files · 75.8 KB · 2446 lines Python 21f · 2337L
Markdown 1f · 105L
YAML 1f · 4L
├─
▾
agents
│ └─
openai.yaml
YAML
├─
▾
scripts
│ ├─
audio_concat.py
Python
│ ├─
audio_denoise.py
Python
│ ├─
audio_extract_replace.py
Python
│ ├─
audio_volume.py
Python
│ ├─
common.py
Python
│ ├─
video_compress_scale.py
Python
│ ├─
video_concat.py
Python
│ ├─
video_convert.py
Python
│ ├─
video_crop_rotate.py
Python
│ ├─
video_firstlast_frame.py
Python
│ ├─
video_gif_convert.py
Python
│ ├─
video_image_compose.py
Python
│ ├─
video_pip.py
Python
│ ├─
video_reverse.py
Python
│ ├─
video_screenshot.py
Python
│ ├─
video_speed.py
Python
│ ├─
video_split.py
Python
│ ├─
video_subtitle.py
Python
│ ├─
video_transition.py
Python
│ ├─
video_trim.py
Python
│ └─
video_watermark.py
Python
└─
SKILL.md
Markdown
Security Positives
✓ All subprocess calls are to declared binaries (ffmpeg, ffprobe) - no arbitrary command execution
✓ No network requests or external API calls - all processing is local as documented
✓ No credential harvesting or sensitive path access
✓ No obfuscation techniques (base64, eval, etc.)
✓ Clean codebase with no IOCs or suspicious patterns
✓ Standard logging to local files only
✓ Input validation prevents path traversal attacks