sora
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a structured interface to the OpenAI Sora Video API. It uses the official Python SDK and follows secure coding practices for argument parsing, input validation, and file handling.
- [EXTERNAL_DOWNLOADS]: The skill downloads generated video assets (MP4, WebP, JPG) from OpenAI's infrastructure to the local project directory. These downloads are a core part of the skill's functionality and target a well-known service.
- [CREDENTIALS_UNSAFE]: The skill implements best practices for secret management by requiring the
OPENAI_API_KEYto be provided via environment variables. It explicitly instructs the user not to share the full key in the chat interface. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided prompts and processes external data such as images and JSONL batch files. This ingestion surface is managed through structured prompt templates and CLI argument normalization, which reduces the risk of accidental instruction obedience.
Audit Metadata