story-film-suite
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads model weights and configuration from trusted well-known services such as Hugging Face and GitHub. These activities are transparently documented as prerequisites for generation tasks.\n- [DYNAMIC_EXECUTION]: The package uses Node.js extensions to spawn local Python scripts from the bundle to handle project state and ComfyUI interaction. This implementation is necessary for the skill's primary purpose and focuses on local script execution.\n- [INDIRECT_PROMPT_INJECTION]: Because the skill processes untrusted data like manuscripts, it implements explicit security protocols and boundary markers. It also includes dedicated evaluation cases to verify that the agent correctly distinguishes instructions from narrative content.\n- [COMMAND_EXECUTION]: An installer script provides a mechanism for local environment setup using standard shell commands for file management within the Pi application directory.\n- [REMOTE_CODE_EXECUTION]: On first use, the skill creates a managed Python runtime and installs official packages from the Comfy-Org repository. These installations are restricted to a private virtual environment and use established industry tools.
Audit Metadata