story-film
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill manages project lifecycle and media processing by executing several local Python scripts. These are invoked using relative paths from the skill's infrastructure.
- Evidence: Reference to scripts including
../../scripts/init_story_project.py,../../scripts/pipeline_progress.py,scripts/comfyui_batch.py,scripts/resource_handoff.py, andscripts/media_toolkit.pyacrossSKILL.mdand various playbooks. - [INDIRECT_PROMPT_INJECTION]: The skill processes extensive user-provided data (story ideas, bibles, screenplays) that are later interpolated into prompts for external generation services, creating a standard surface for indirect injection.
- Ingestion points: User-controlled content stored in project files such as
brief.md,characters.md, andscreenplay.fountainwithin the00_project,01_story, and02_screenplaydirectories. - Boundary markers: The provided instructions do not specify the use of explicit delimiters or instructions to ignore embedded commands within the prompt templates.
- Capability inventory: The skill can execute local shell scripts, perform file system writes, and initiate network requests to ComfyUI API endpoints.
- Sanitization: There is no documentation of content filtering or escaping of user data prior to its use in downstream prompt generation.
- [DYNAMIC_EXECUTION]: The skill supports generating and executing dynamic content for media rendering, such as video compositions and tool manifests.
- Evidence:
playbooks/programmatic-video.mddescribes generating "coded-video compositions," andplaybooks/media-editing-and-project-export.mdmentions executing aTOOL-###manifest through a specialized toolkit script.
Audit Metadata