create-cinematic-music-video
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Pipeline Orchestration. The skill uses the
subprocessmodule to manage a multi-stage production workflow. Theone_shot.pydriver coordinates execution between several internal scripts, whilestitch.pyinvokesffmpegfor media processing andgen_keyframes.py/gen_clips.pyuse thehiggsfieldCLI tool for content generation. - [COMMAND_EXECUTION]: Search Path Best Practice. The
stitch.pyscript includes a fallback search for theffmpegbinary in/private/tmp/ffmpeg-full/ffmpeg. While this is an insecure location for binary discovery on multi-user systems, the skill prioritizes theimageio-ffmpegPython package, and the finding is considered a best-practice violation rather than a direct threat in this context. - [EXTERNAL_DOWNLOADS]: Media Asset Acquisition. The generation scripts
gen_keyframes.pyandgen_clips.pyuseurllib.requestto download generated images and videos from temporary URLs provided by the content generation service. These downloads are limited to media file formats. - [EXTERNAL_DOWNLOADS]: Remote API Integration. The skill interfaces with the ElevenLabs API for music and timestamp generation via a shared utility script, which is a standard requirement for the skill's stated purpose.
- [COMMAND_EXECUTION]: Local Script Invocation. The driver script
one_shot.pydynamically executes other Python and Shell scripts within the skill's folder usingsubprocess.runto advance the production state machine.
Audit Metadata