render-cinematic-music-video

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONNO_CODE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides detailed instructions for executing external CLI tools, specifically the higgsfield CLI, to generate images and video clips. It also outlines complex FFmpeg filter chains for scaling, cropping, and muxing audio as part of the assembly process described in scripts/PIPELINE.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from a configuration file (e.g., config.json), such as keyframe_prompt and motion_hint, which are subsequently used to drive external capabilities. This creates a potential surface for command or prompt injection.
  • Ingestion points: External configuration fields in scripts/config.example.json including tableaux[].keyframe_prompt, tableaux[].motion_hint, and song.prompt.
  • Boundary markers: No explicit boundary markers or "ignore instructions" warnings are present to delimit user-provided prompts from system instructions.
  • Capability inventory: The skill utilizes subprocess calls to the higgsfield CLI and executes complex FFmpeg commands as detailed in scripts/PIPELINE.md.
  • Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is interpolated into shell command arguments.
  • [NO_CODE]: The provided skill files consist of documentation and configuration examples but do not include the actual executable logic. The skill refers to external Python scripts (e.g., stitch.py, gen_keyframes.py, build_word_timestamps.py) that are assumed to be present in the execution environment or a specific relative directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 05:21 AM
Security Audit — agent-trust-hub — render-cinematic-music-video