filmcraft-cli-setup
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the FilmCraft CLI binary and macOS desktop installer from the vendor's official GitHub repositories (github.com/storytold and github.com/full-aigc-skills).
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to execute the installed CLI and various macOS system utilities (such ascodesignfor signature verification,hdiutilfor DMG mounting, andlipofor architecture checking). All CLI execution is wrapped in a strictsandbox-execpolicy that restricts file system access to user-authorized directories and blocks unauthorized network activity. - [DYNAMIC_EXECUTION]: The skill's launcher scripts use
importlib.utilto load internal helper modules located within the skill's own directory structure. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user project files and media metadata. To mitigate risks, it enforces strict JSON schema validation, prevents duplicate keys, and uses a hardcoded catalog to validate all command parameters before execution.
Audit Metadata