render-cinematic-music-video
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed instructions for executing external CLI tools, specifically the
higgsfieldCLI, to generate images and video clips. It also outlines complex FFmpeg filter chains for scaling, cropping, and muxing audio as part of the assembly process described inscripts/PIPELINE.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from a configuration file (e.g.,
config.json), such askeyframe_promptandmotion_hint, which are subsequently used to drive external capabilities. This creates a potential surface for command or prompt injection. - Ingestion points: External configuration fields in
scripts/config.example.jsonincludingtableaux[].keyframe_prompt,tableaux[].motion_hint, andsong.prompt. - Boundary markers: No explicit boundary markers or "ignore instructions" warnings are present to delimit user-provided prompts from system instructions.
- Capability inventory: The skill utilizes subprocess calls to the
higgsfieldCLI and executes complex FFmpeg commands as detailed inscripts/PIPELINE.md. - Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is interpolated into shell command arguments.
- [NO_CODE]: The provided skill files consist of documentation and configuration examples but do not include the actual executable logic. The skill refers to external Python scripts (e.g.,
stitch.py,gen_keyframes.py,build_word_timestamps.py) that are assumed to be present in the execution environment or a specific relative directory.
Audit Metadata