Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This skill installs as a small Bash wrapper around FFmpeg. It takes a video path, an optional --time or --index, and an --out image path, then writes one extracted frame. The package does not contact the network, read credentials, spend money, or install persistence. The main caution is that the --index value is placed into an FFmpeg filter expression without numeric validation, and FFmpeg overwrites output files automatically. These are consistent with the declared purpose but are worth a quick review.
| Declared purpose | Extract frames or short clips from videos using ffmpeg. |
| Observed behavior | The included Bash script checks that the input file exists, creates the output directory, runs ffmpeg with -y to write a single frame image, and prints the output path. The SKILL.md files provide shell command examples using the script. No network calls, credential access, payment behavior, persistence, hidden destinations, or downloaded code were observed in the package. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The script runs Bash and executes ffmpeg. See scripts/frame.sh line 1 and ffmpeg invocations at lines 62-78. |
| filesystem_read | needed | It reads the input video file supplied by the caller after a file-existence check. |
| filesystem_write | needed | It creates the output directory and writes the extracted frame to the supplied --out path; ffmpeg uses -y to overwrite. |
| install_packages | needed | Metadata declares ffmpeg as required and provides a brew install action if ffmpeg is missing. |
| severity | finding |
|---|---|
| info | Declares ffmpeg dependency and brew install action The metadata says ffmpeg is required and offers a brew formula install. This matches the skill's purpose of video frame extraction. SKILL.md:5 "requires":{"bins":["ffmpeg"]},"install":[{"id":"brew","kind":"brew","formula":"ffmpeg" |
| info | Runs a Bash script The packaged logic is a Bash script that invokes ffmpeg. scripts/frame.sh:1 #!/usr/bin/env bash |
| info | Checks input video exists The script checks only that the input path exists and is a regular file. It does not inspect or validate video content. scripts/frame.sh:49 if [[ ! -f "$in" ]]; then |
| low | Automatically creates output directories The script creates parent directories for the output path. A caller can request an arbitrary path the agent can write to. scripts/frame.sh:59 mkdir -p "$(dirname "$out")" |
| low | Overwrites output without confirmation The script runs ffmpeg with -y, so an existing file at the output path is overwritten. This is normal for non-interactive image extraction but should be understood by users. scripts/frame.sh:62 ffmpeg -hide_banner -loglevel error -y \ |
| low | Unvalidated --index reaches FFmpeg filter expression The --index value is placed directly into an FFmpeg filter graph string. It is not validated as a non-negative integer, so malformed or adversarial values could alter FFmpeg filter parsing. The package itself documents this risk in skill-card.md line 28. scripts/frame.sh:64 -vf "select=eq(n\\,${index})" \ |
| low | Known limitation documented by publisher The publisher warns that the index argument is not validated and recommends passing simple numeric --index values. skill-card.md:28 Risk: The frame index argument is not validated as a non-negative integer before it is placed into the FFmpeg filter expression. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| ffmpeg.org | not in the service index | SKILL.md:4 |
| Binaries invoked | bash |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 29 | 7e24245498aca878… |
_meta.json | 6 | 4fefcf4b4c733bbe… |
scripts/frame.sh | 81 | b339455e9e618c83… |
skill-card.md | 54 | ef85cae5441ac271… |
For agents
JSON: https://agenteconomy.report/k/video-frames.audit.json · badge: https://agenteconomy.report/k/video-frames.audited.svg ·
skill rating: /k/video-frames · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).