video-generator
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Higgsfield CLI and JavaScript SDK for authentication and media handling. It recommends installation via standard package managers (npm) from official sources (
@higgsfield/cliandhiggsfield-ai/skills). - [COMMAND_EXECUTION]: The workflow includes a final step that executes a local media packaging tool using
uv run media-projectto assemble the generated clips into an OpenShot project file. - [DATA_EXFILTRATION]: The skill uploads media files (storyboard frames and references) to the Higgsfield MCP endpoint (
mcp.higgsfield.ai). As this is a well-known service intended for this specific purpose and no sensitive credentials or system files are accessed, this is classified as safe operational behavior. - [PROMPT_INJECTION]: While the skill processes project-provided manifests and prompt files, it implements a 'Prompt Flattening' algorithm that acts as a structural filter. This algorithm appends explicit constraints (e.g., 'No narration', 'Preserve references') to the model-native prompt to maintain control over the output.
Audit Metadata