Interview Bank

Build an AI Short-Drama Production Pipeline With Agents in 14 Days

D6 The Editing Bay: Assembling Footage Into One Vertical Cut With ffmpeg

• What are the risks of letting an LLM generate ffmpeg command lines directly, and how would you redesign it?如果让大模型直接生成 ffmpeg 命令来合成视频，会有什么风险？你会怎么改造这个设计？

  Common in ChinaCommon overseasDeep dive#prompt-injection#pipeline-design#reproducibility

  How to reason about it · think before answering

  1. This probes where you draw the line between model judgment and real execution. Saying 'injection risk' is the passing bar; missing reproducibility and debuggability signals you have not run a generative pipeline in production.
  2. The chain is short: model output is untrusted input, untrusted input into a shell is command injection, model output is also nondeterministic, nondeterministic commands mean the same input yields different files, and debugging then requires guessing what the model was thinking.
  3. The fix is not 'validate and forward'. Move the model: let it emit only structured choices drawn from an enum you fixed in advance (transition type, crop strategy, which shot the cover comes from), and compute the command yourself from the timeline with a pure function.
  4. Add the concrete detail: invoke external binaries with an argument array (execFile, not exec) so escaping stops being a class of bug, then whitelist-validate the model's choices and fall back to a default instead of erroring.
  5. Expect the follow-up 'so what is the model still good for here'. Answer: taste calls — tone, cover selection, whether to use a transition. Judgment to the model, execution to the program. That boundary generalizes to any agent with side effects.

  分析过程 · 先想清楚再作答

  1. 这题考的是「Agent 到底能不能碰真实执行」这条边界，区分度在于你会不会主动说出安全之外的两条。只答「有注入风险」是及格线，答不出可复现与可调试就说明没在生产里跑过生成式流水线。
  2. 推导链很短：模型的输出是不可信输入 → 不可信输入进 shell 就是命令注入 → 而且模型输出天然不确定 → 不确定的命令意味着同样的输入产出不同的文件 → 排查时你还得先猜模型当时为什么那么写。三条风险分别对应安全、可复现、可调试。
  3. 改造的方向不是「加一层校验就放行」，而是把模型挪到另一个位置：让它只输出结构化的选择项，且每一项都从你定死的枚举里选（转场类型、裁切策略、封面取哪一镜），命令本身由你自己的纯函数从时间轴算出来。
  4. 补一句更硬的落地细节：调用外部程序不要走 shell 字符串，用参数数组（execFile 而不是 exec），从根上消掉转义问题；再加一层白名单校验，模型给出枚举外的值就退回默认值而不是报错。
  5. 可预期的追问是「那模型在这一环还有什么用」。答：用在需要审美判断的地方——情绪偏冷还是偏暖、封面选哪一镜、要不要转场。判断交给模型，执行留给程序，这是所有会产生副作用的 Agent 场景的通用分界。

  Key points

  • Three risks in order: command injection, non-reproducible output, undebuggable failures. Naming only the first is not enough.
  • Turn the model into a parameter filler: structured choices constrained to a predefined enum.
  • Generate the command from the timeline with a pure function, invoked via an argument array rather than a shell string.
  • Whitelist-validate and fall back to defaults for out-of-enum values instead of surfacing an error.
  • One-line boundary: the model decides, the program executes.

  答题要点

  • 三条风险按严重度排：命令注入、结果不可复现、报错不可调试；只说第一条不够。
  • 改造成参数填充器：模型输出结构化选择项，取值必须落在预定义枚举里。
  • 命令由程序的纯函数从时间轴生成，用参数数组调用而不是拼 shell 字符串。
  • 白名单校验兜底，枚举外的值退回默认，而不是把错误抛给用户。
  • 分界线一句话：模型负责判断，程序负责执行。