Is video-frames safe?
https://clawhub.ai/skill/video-frames
This is a minimal, well-structured skill that wraps ffmpeg for single-frame extraction from video files. The shell script is clean, uses safe bash options (set -euo pipefail), and performs no network activity, file exfiltration, or prompt manipulation. The only minor concern is unvalidated parameter interpolation into ffmpeg's filter string, which poses negligible real-world risk.
Category Scores
Findings (4)
LOW Shell script with ffmpeg filter string interpolation -8 ▶
The frame.sh script interpolates the --index parameter directly into ffmpeg's -vf select filter: select=eq(n,${index}). While ffmpeg's filter parser is not a general-purpose shell and limits exploitability, a malicious or confused agent could theoretically pass crafted values. The script does not validate that --index is a numeric value before use.
LOW Executable shell script included in skill -4 ▶
The skill includes frame.sh, an executable bash script. This is expected for a CLI-wrapping skill and the script is straightforward, but any executable code warrants noting.
INFO Homepage URL in metadata -3 ▶
The skill metadata includes a homepage URL (https://ffmpeg.org). This is a static reference and not an instruction for the agent to fetch, but is noted for completeness.
INFO HTTPS connection during install to external IP -5 ▶
A single HTTPS connection to 216.150.1.1:443 was observed during installation. This is consistent with the ClawHub registry package download and is expected behavior.