ai-film-director
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands to manage project workspace and files. It executes a local script
./scripts/new-project.shfor initial project scaffolding and employs standard filesystem utilities likemkdir,mv,cp, andlsto organize character references, environment plates, and generated clips. These operations are restricted to the project's local directory structure and are essential for its workflow orchestration. - [DYNAMIC_EXECUTION]: The skill generates a local HTML file (
color-palette-preview.html) based on user-defined color preferences and uses the system'sopencommand to display it in a browser. This provides a visual preview of the project's aesthetic palette. This behavior is transparent, localized, and involves no remote execution of untrusted code. - [EXTERNAL_DOWNLOADS]: The skill directs users to interact with legitimate external services including ArtCraft, Higgsfield, Suno, and Topaz Video AI. It provides links to official documentation and service domains. These references are appropriate for the skill's purpose and follow best practices for external tool integration.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text (concept briefs, character traits, and lyrics) and interpolates it into prompts sent to secondary AI models. While this presents a surface for potential instruction injection, the risk is localized to the generation of creative assets and is mitigated by the skill's highly structured prompt templates and manual human-in-the-loop review process at every stage.
Audit Metadata