khe-launch-film
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves processing user-provided JSON plans and Markdown beat sheets. This represents a vulnerability surface for indirect prompt injection. However, the skill's instructions and the provided verification script focus on extracting and validating specific numeric and structural metrics, which inherently mitigates the risk of the agent executing arbitrary natural language instructions embedded in the data files.
- [COMMAND_EXECUTION]: The verification script (
scripts/film-check.mjs) executes theffprobebinary to audit the duration, frame rate, and encoding parameters of video renders. This command execution is performed using safe parameters (no shell spawning) and is strictly limited to extracting metadata necessary for the skill's auditing function.
Audit Metadata