openmontage
Warn
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Clones the OpenMontage repository from 'https://github.com/calesthio/OpenMontage.git'.
- [REMOTE_CODE_EXECUTION]: Executes 'make setup' and 'npm install' within the cloned repository, leading to the installation of arbitrary third-party dependencies from external registries.
- [DYNAMIC_EXECUTION]: Employs 'python -c' and 'python -' to execute code that dynamically imports and runs modules (e.g., 'tools.tool_registry', 'lib.checkpoint') from the local checkout.
- [COMMAND_EXECUTION]: Utilizes shell commands ('git', 'make', 'npm', 'npx') and Python execution to manage video production workflows, project state, and contract testing.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and follows instructions from YAML manifests and Markdown director files stored in the external repository, creating a surface for indirect prompt injection if the repository content is compromised.
- Ingestion points: 'pipeline_defs/.yaml', 'skills/pipelines/.md', and 'references/*.md' from the cloned repository.
- Boundary markers: No explicit delimiters or instruction-isolation markers are used when the agent reads these external files.
- Capability inventory: The skill has access to Bash, file system Write/Edit, and Python execution.
- Sanitization: A custom 'pipeline_inventory.py' script is used for structural YAML validation, but no sanitization is applied to the instructional content of the files.
Audit Metadata