Skills
Navigate
skills/full-aigc-skills/filmcraft-skills/filmcraft-color-match/Gen Agent Trust Hub

filmcraft-color-match

Fail

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The file references/craft-command-evidence.json contains a link to download a ZIP archive containing a binary executable (filmcraft-cli.exe) from an untrusted third-party repository (storytold/filmcraft).
  • [REMOTE_CODE_EXECUTION]: The instructions in references/craft-methods.md guide the agent to run the downloaded filmcraft-cli.exe binary to execute video processing tasks, which involves running untrusted external code.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data that could influence its execution flow.
  • Ingestion points: External media files and project data (SKILL.md, references/craft-methods.md).
  • Boundary markers: Absent; no technical delimiters are used to wrap external content.
  • Capability inventory: Shell command execution via command_run and file writing via save_file (SKILL.md, references/craft-methods.md).
  • Sanitization: Absent; the skill does not validate input data before using it in CLI arguments.
  • [DYNAMIC_EXECUTION]: The skill uses templates from references/craft-steps.json to generate steps.jsonl files at runtime, which are then processed and executed by the CLI tool.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 23, 2026, 10:16 AM