Video Edit Compare

• Outcome: Review
• Latest audit: Jul 22, 2026 · 2:13 PM UTC
• Version: 1.0.1

Overview

This skill coherently renders and verifies a side-by-side video comparison, with its file writes and ffmpeg use aligned with that purpose.

Install this only for projects where you are comfortable letting it run ffmpeg/ffprobe on the videos you name and create or update review files under the project workspace. Review the output path before running, because the script creates parent directories and overwrites the requested output video via ffmpeg's -y behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _probe(path):
    result = subprocess.run(
        [
            "ffprobe", "-v", "error", "-select_streams", "v:0",
            "-show_entries", "stream=width,height:format=duration", "-of", "json", str(path),

• Confidence: 70% confidence
• Finding: result = subprocess.run( [ "ffprobe", "-v", "error", "-select_streams", "v:0", "-show_entries", "stream=width,height:format=duration", "-of", "json", str(path),

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _audio_hash(path):
    result = subprocess.run(
        [
            "ffmpeg", "-hide_banner", "-loglevel", "error", "-i", str(path),
            "-map", "0:a:0", "-c", "copy", "-f", "hash", "-hash", "md5", "-",

• Confidence: 70% confidence
• Finding: result = subprocess.run( [ "ffmpeg", "-hide_banner", "-loglevel", "error", "-i", str(path), "-map", "0:a:0", "-c", "copy", "-f", "hash", "-hash", "md5", "-",

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _crop_bytes(path, at_s, x, y, size):
    sample_size = min(16, size)
    result = subprocess.run(
        [
            "ffmpeg", "-hide_banner", "-loglevel", "error", "-ss", f"{at_s:.6f}",
            "-i", str(path), "-vf",

• Confidence: 70% confidence
• Finding: result = subprocess.run( [ "ffmpeg", "-hide_banner", "-loglevel", "error", "-ss", f"{at_s:.6f}", "-i", str(path), "-vf", f"crop={size}:{size}:{x}:{y},sc

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if args.filter_only:
        return
    Path(args.output).parent.mkdir(parents=True, exist_ok=True)
    subprocess.run(command, check=True)
    output = Path(args.output).resolve()
    verify_output(timeline, args.source, args.final, output)
    parts = source_time_parts(timeline)

• Confidence: 70% confidence
• Finding: subprocess.run(command, check=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This code writes a filtergraph file, a compare-plan JSON file, project metadata, and a comparison summary markdown file, and also creates parent directories. While these writes are part of the tool's function, there is no confirmation prompt, user-facing log before the writes, or inline warning/comment explaining that the script modifies project files beyond the requested output video.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_make_compare.py:9