Audio Editor

Perform audio editing tasks including trimming, volume adjustment, format conversion, and extracting audio from video files using natural language commands.

Security Scan

The skill's purpose (audio editing) matches its code, but the included script executes constructed shell commands with eval and lacks input sanitization — this can run arbitrary commands beyond the stated audio tasks.

Purpose & Capability

Skill claims audio editing and the script performs ffmpeg-based operations, which is consistent. However the registry metadata lists no required binaries while SKILL.md names ffmpeg >= 5.0; the script also relies on grep -P and bc but those are not declared. This mismatch between declared requirements and actual runtime needs is worth noting.

Instruction Scope

The runtime script (scripts/audio_run.sh) parses natural-language input but falls back to echoing the raw user-provided string and then runs eval on it. That means if the command doesn't match the simple parsing rules the script will execute arbitrary shell code supplied by the user. Constructed ffmpeg commands are built without robust quoting/escaping, so malicious or malformed filenames or input could lead to command injection or unintended shell execution. The SKILL.md does not warn about this behaviour or limit allowed inputs.

Install Mechanism

No install spec (instruction-only plus a helper script). Nothing is downloaded or written by an installer, which reduces supply-chain risk. The script itself will run locally when invoked.

Credentials

The skill requests no credentials or special environment variables. It does use $HOME for a default output path and expects ffmpeg, grep (with -P support), and bc to be available — these are reasonable for audio processing but were not fully declared in registry metadata.

Persistence & Privilege

always is false and the skill is user-invocable only. It does not request persistent system-wide changes or modify other skills/configs.

What to consider before installing

This skill performs audio work with ffmpeg, which matches its description, but the included script constructs shell commands and uses eval on user-provided text. That allows arbitrary shell execution if input is not strictly controlled. Before installing or running: (1) ensure you trust the skill source; (2) inspect and test the script in a safe environment; (3) do not run it with untrusted natural-language inputs; (4) consider patching the script to remove eval, build command arrays, properly quote/escape filenames, and whitelist acceptable operations; (5) ensure ffmpeg, grep -P, and bc are available. If you need the same functionality in a higher-security context, prefer a version that avoids eval and validates inputs.

Description

音频处理技能，支持剪辑、音量调整、格式转换、提取视频音频等操作。

Dependencies

• ffmpeg >= 5.0

Commands

edit_audio

• Description: 自然语言执行音频处理
• Parameters:
  • command: 音频处理需求（必填）
  • output: 输出路径（可选）
• Output: 处理后的音频路径

extract_audio

• Description: 从视频提取音频
• Parameters:
  • input: 视频路径（必填）
  • output: 输出音频路径（可选）
• Output: 提取的音频路径