captions-filmcraft
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill scripts utilize the subprocess module to interact with local binaries and media processing tools.
- Evidence:
fc_captions.pyexecutesfilmcraft-cli,ps,ffmpeg,fc-match,magick,fc-list, andfc-cacheto perform project modifications and font management. - Evidence:
fc_inserts.pyexecutesfilmcraft-clito inspect and modify project timelines. - [DYNAMIC_EXECUTION]: The skill dynamically modifies the Python module search path to load logic from other local agent extensions.
- Evidence:
fc_captions.pymanipulatessys.pathto import scripts from thetranscribeandfilmcraftskills, assuming they are located in standard local directories. - [EXTERNAL_DOWNLOADS]: The documentation specifies several third-party tool and library dependencies required for local operation.
- Evidence:
SKILL.mdlists prerequisites includingfilmcraft-cli,ffmpeg,numpy,onnx-asr, andfaster-whisper. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external project data and script files, which defines a potential (though standard) attack surface for prompt injection.
- Ingestion points: Reads FilmCraft
.fcprojfiles and local.txtscript files. - Boundary markers: Not present; the content is processed as functional data for the automation.
- Capability inventory: Executes project-scoped commands via
filmcraft-cliand performs file system writes to the project directory. - Sanitization: No explicit sanitization of ingested script text is mentioned.
Audit Metadata