Trust Assessment
FFmpeg Video Editor received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential for FFmpeg command injection via unsanitized user input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential for FFmpeg command injection via unsanitized user input The skill instructs the LLM to generate FFmpeg shell commands by interpolating user-provided parameters (e.g., filenames, timestamps, filter values) directly into command patterns. The skill does not provide any explicit instructions for sanitizing these parameters. This lack of sanitization guidance means that malicious user input (e.g., containing shell metacharacters like `;`, `|`, `&`, `$(...)`, or quotes) could be directly inserted into the generated FFmpeg commands, leading to arbitrary command execution in the environment where these commands are run. For instance, if a user provides a filename like `'; rm -rf /;'`, the generated command could execute `rm -rf /`. Instruct the LLM to rigorously sanitize all user-provided parameters before incorporating them into FFmpeg commands. Specifically, ensure that all filenames and other string parameters are properly escaped or quoted to prevent shell metacharacter interpretation. For example, advise the LLM to escape single quotes within single-quoted strings, double quotes within double-quoted strings, and to escape or disallow shell metacharacters. For the `subtitles='SUBTITLE_FILE'` case, ensure `SUBTITLE_FILE` is properly escaped for single quotes. For `files.txt` generation, ensure filenames are sanitized before being written to the file. | LLM | SKILL.md:13 |
Scan History
Embed Code
[](https://skillshield.io/report/c0add675f20ae777)
Powered by SkillShield