create-cinematic-music-video

Pass

Audited by Gen Agent Trust Hub on Jul 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Pipeline Orchestration. The skill uses the subprocess module to manage a multi-stage production workflow. The one_shot.py driver coordinates execution between several internal scripts, while stitch.py invokes ffmpeg for media processing and gen_keyframes.py/gen_clips.py use the higgsfield CLI tool for content generation.
  • [COMMAND_EXECUTION]: Search Path Best Practice. The stitch.py script includes a fallback search for the ffmpeg binary in /private/tmp/ffmpeg-full/ffmpeg. While this is an insecure location for binary discovery on multi-user systems, the skill prioritizes the imageio-ffmpeg Python package, and the finding is considered a best-practice violation rather than a direct threat in this context.
  • [EXTERNAL_DOWNLOADS]: Media Asset Acquisition. The generation scripts gen_keyframes.py and gen_clips.py use urllib.request to download generated images and videos from temporary URLs provided by the content generation service. These downloads are limited to media file formats.
  • [EXTERNAL_DOWNLOADS]: Remote API Integration. The skill interfaces with the ElevenLabs API for music and timestamp generation via a shared utility script, which is a standard requirement for the skill's stated purpose.
  • [COMMAND_EXECUTION]: Local Script Invocation. The driver script one_shot.py dynamically executes other Python and Shell scripts within the skill's folder using subprocess.run to advance the production state machine.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 10, 2026, 03:07 PM
Security Audit — agent-trust-hub — create-cinematic-music-video