filmcraft-subtitle-delivery
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/sync_srt.pyscript executes a local binary usingsubprocess.run. The path to the executable is provided via the--cliargument, enabling the skill to interface with the FilmCraft command-line tool. The execution uses a list of arguments and does not invoke a shell, following standard security practices for process spawning. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from subtitle files (SRT/VTT) for processing and editing.
- Ingestion points: Subtitle content is read from user-provided files within
scripts/sync_srt.pyvia the--inputparameter. - Boundary markers: The script performs structural validation of the subtitle format using regular expressions for timestamps, but it does not employ specific security boundaries to isolate the text content of the subtitles.
- Capability inventory: The skill possesses the ability to execute shell commands via the specified CLI and write output files to the local filesystem.
- Sanitization: While the script validates the temporal structure and sequence of the subtitles, the actual text content is passed through to the editing commands without additional sanitization.
- [EXTERNAL_DOWNLOADS]: The skill's documentation references an official binary release of the FilmCraft tool hosted on GitHub. This reference targets a well-known service and is documented as a resource for the user/agent to fulfill the skill's requirements.
Audit Metadata