Audit History

This skill is a legitimate video enhancement tool that wraps the verging.ai API. Static analysis flagged shell commands (ffmpeg, curl, yt-dlp), env var access (VERGING_API_KEY), network calls to verging.ai, and temp directory usage. After evaluation, all findings are false positives: the shell commands are standard video processing tool invocations documented for instructional purposes, the API key access follows best practices (env var only), and network calls are to the documented verging.ai API. The combination heuristic is expected for a skill that processes media files via a cloud API. No malicious intent detected.

Evaluation of 76 static findings found all critical and high severity items to be false positives in legitimate context. The skill is a video enhancement API client that invokes standard tools (yt-dlp, ffmpeg, curl) and makes API calls to verging.ai. The 'dangerous combination' heuristic triggered on the standard pattern of shell commands + network + API key, but no malicious intent was found. No prompt injection or obfuscation detected. The 'weak crypto' finding is a false positive triggered by API key format strings, not cryptographic implementation.

This is a legitimate video enhancement skill that integrates with the verging.ai API service. Static analysis flagged 82 patterns, but most are false positives: hardcoded URLs are documented public API endpoints, API key references are for user-provided authentication (not secret exfiltration), and shell commands in documentation are usage examples for ffmpeg/yt-dlp/curl. The skill requires network access for API calls, environment variable for user API key, external tools for video processing, and temp directory for file handling. These are expected behaviors for a video processing tool. Risk level is LOW due to external service dependency and third-party API usage.

All static analysis findings are false positives representing legitimate functionality for a video processing tool. Network requests are made to documented verging.ai API endpoints. External commands (ffmpeg, ffprobe, curl, yt-dlp) are standard video processing tools with hardcoded arguments. Environment variables store API keys as documented. No prompt injection attempts or malicious patterns detected.