story-film

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill manages project lifecycle and media processing by executing several local Python scripts. These are invoked using relative paths from the skill's infrastructure.
  • Evidence: Reference to scripts including ../../scripts/init_story_project.py, ../../scripts/pipeline_progress.py, scripts/comfyui_batch.py, scripts/resource_handoff.py, and scripts/media_toolkit.py across SKILL.md and various playbooks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes extensive user-provided data (story ideas, bibles, screenplays) that are later interpolated into prompts for external generation services, creating a standard surface for indirect injection.
  • Ingestion points: User-controlled content stored in project files such as brief.md, characters.md, and screenplay.fountain within the 00_project, 01_story, and 02_screenplay directories.
  • Boundary markers: The provided instructions do not specify the use of explicit delimiters or instructions to ignore embedded commands within the prompt templates.
  • Capability inventory: The skill can execute local shell scripts, perform file system writes, and initiate network requests to ComfyUI API endpoints.
  • Sanitization: There is no documentation of content filtering or escaping of user data prior to its use in downstream prompt generation.
  • [DYNAMIC_EXECUTION]: The skill supports generating and executing dynamic content for media rendering, such as video compositions and tool manifests.
  • Evidence: playbooks/programmatic-video.md describes generating "coded-video compositions," and playbooks/media-editing-and-project-export.md mentions executing a TOOL-### manifest through a specialized toolkit script.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 08:41 AM