Security audit
Security checks for vulnerabilities and agentic risk
The skill largely matches its video-ad purpose, but one script can delete a local directory path influenced by the product config, so untrusted configs need review.
Only run this skill with configs you created or trust. Before running, make sure output_name is a plain filename such as product-ad.mp4 with no slashes or .. path segments, and consider running it in a dedicated working directory or container until the temp-directory cleanup is hardened.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
out_dir.mkdir(parents=True, exist_ok=True)
# Get video duration
r = subprocess.run(
['ffprobe', '-v', 'quiet', '-show_entries', 'format=duration',
'-of', 'csv=p=0', str(video)],
capture_output=True, text=True
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print(f'📹 {video.name} — {duration:.1f}s → extracting {n_frames} frames at 1fps...')
subprocess.run([
'ffmpeg', '-y', '-i', str(video),
'-vf', 'fps=1,scale=480:-1',
str(out_dir / 'f_%02d.jpg'),
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd, label=''):
r = subprocess.run(cmd, capture_output=True, text=True)
if r.returncode != 0:
print(f'ERROR [{label}]:\n{r.stderr[-800:]}')
raise SystemExit(1)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def get_duration(path):
r = subprocess.run(
['ffprobe', '-v', 'quiet', '-show_entries', 'format=duration', '-of', 'csv=p=0', str(path)],
capture_output=True, text=True
)
The script recursively deletes a path derived in part from untrusted configuration data via cfg['output_name'], with no path canonicalization or boundary check before shutil.rmtree(tmp). If a crafted output_name contains path traversal sequences, tmp may resolve outside the intended output directory, allowing deletion of unintended directories writable by the user running the script.
This code creates output directories, writes multiple temporary files, and generates concat list files, but the only disclosure is generic progress output rather than an explicit warning that the script will create and later delete working files. Under the code-file criteria, file writes should have some visible disclosure, comment, or warning; here the behavior is only implicitly described in the module docstring and progress logs.
No suspicious patterns detected.