filmcraft-video-export
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a download URL for a versioned Windows portable distribution of the Filmcraft tool from its official GitHub repository (storytold/filmcraft). A SHA256 hash is provided for integrity verification of the archive.- [COMMAND_EXECUTION]: Detailed instructions are provided for executing the downloaded 'filmcraft-cli.exe' binary to handle project management and video encoding tasks. This includes assembling command-line arguments and executing structured JSONL steps.- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect injection surface by ingesting untrusted data from external sources and processing it using exploitable capabilities.
- Ingestion points: Reads project configuration files (.fcproj) and sequence metadata via 'open_file' and 'sequence.inspect'.
- Boundary markers: No delimiters or instructions to ignore embedded commands within the ingested project data were found.
- Capability inventory: Includes file system modifications (save_file, save_project), web engine command execution (command_run), and subprocess execution of the Filmcraft CLI.
- Sanitization: There is no evidence of validation, escaping, or filtering of the content retrieved from external project files.
Audit Metadata