AI Audit: Findings and Recommendations

[koxon]

Summary\n\nTwo-pass audit of all 23 FFmpeg transcoding presets covering encoding quality, security, codec currency, HLS/DASH gaps, and mobile compatibility.\n\nDeliverables:\n- FINDINGS.md — Structured findings (2 Critical, 4 High, 7 Medium, 4 Low) + agent skill improvements + positive observations\n- CLAUDE.md — Improved with full preset inventory tables, codec info, usage patterns, deployment flow, and all gotchas\n\n## Key Findings\n\nCritical:\n- C-1: video_codec_options parser uses = but presets use : — profile/level/refs are silently ignored on every transcode\n- C-2: custom_cmd allows arbitrary command injection (cross-repo, lives in CloudTranscode)\n\nHigh:\n- H-1: kindleFireHDX-generic.json has invalid JSON (trailing comma) + missing field — completely broken\n- H-2: No modern codecs (H.265, VP9, AV1) — ~30-50% wasted bandwidth\n- H-3: HLS presets use non-standard resolutions (hls2M outputs 4:3)\n- H-4: No DASH/CMAF presets for Android-native adaptive streaming\n\nMedium: Baseline profile on 1080p/720p, inconsistent frame rates, broken S3 backup workflow, no CI validation, libfdk_aac dependency risk, auto-scale bypasses enlargement check\n\n## Test plan\n\n- [ ] Review FINDINGS.md for accuracy of technical claims\n- [ ] Verify C-1 parser mismatch by testing explode(\"=\", \"Profile:baseline\") in PHP\n- [ ] Validate H-1 by running jq . kindleFireHDX-generic.json (should fail)\n- [ ] Confirm HLS resolution claims against Apple HLS Authoring Spec\n- [ ] Check if any legacy device presets are still actively referenced in job configs\n\n🤖 Generated with Claude Code"