director
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
ffmpegfor final video assembly. It constructs a local manifest file (concat_list.txt) and executesffmpeg -f concatto join generated clips. This behavior is necessary for the skill's stated purpose and operates entirely on locally generated assets. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill writes project metadata and state to a local JSON file at
~/code/comfyui-mcp/workflows/. This is a standard practice for state persistence in local media workflows and does not involve network exfiltration or access to sensitive credentials. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided story text is used as the basis for model prompt generation in SKILL.md.
- Boundary markers: The skill does not explicitly define delimiters to isolate user-supplied story content from the structured instructions passed to the AI models.
- Capability inventory: The skill has the capability to write files locally and execute shell commands (
ffmpeg). - Sanitization: No specific sanitization or filtering of the input story text is described, though the command construction for
ffmpegutilizes internally managed project identifiers.
Audit Metadata