skills/artokun/comfyui-mcp/director/Gen Agent Trust Hub

director

Pass

Audited by Gen Agent Trust Hub on Apr 8, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses ffmpeg for final video assembly. It constructs a local manifest file (concat_list.txt) and executes ffmpeg -f concat to join generated clips. This behavior is necessary for the skill's stated purpose and operates entirely on locally generated assets.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill writes project metadata and state to a local JSON file at ~/code/comfyui-mcp/workflows/. This is a standard practice for state persistence in local media workflows and does not involve network exfiltration or access to sensitive credentials.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: User-provided story text is used as the basis for model prompt generation in SKILL.md.
  • Boundary markers: The skill does not explicitly define delimiters to isolate user-supplied story content from the structured instructions passed to the AI models.
  • Capability inventory: The skill has the capability to write files locally and execute shell commands (ffmpeg).
  • Sanitization: No specific sanitization or filtering of the input story text is described, though the command construction for ffmpeg utilizes internally managed project identifiers.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 8, 2026, 11:39 PM
Security Audit — agent-trust-hub — director