filmcraft
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/fc.py executes system commands and the filmcraft-cli utility using subprocess.run. It uses structured argument lists which mitigates shell injection risks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project files (.fcproj) and command sequences (.jsonl). While it lacks explicit input sanitization for these files, it operates within the local project context for video editing.
- [PERSISTENCE]: The scripts/setup.sh script modifies local desktop entry files (.desktop) to ensure the FilmCraft application launches via a custom wrapper. This is used to enable the bridge communication feature.
- [CREDENTIALS_UNSAFE]: The skill manages a local control token used to authenticate the bridge between the agent and the application. The token is generated using a cryptographically secure method (secrets.token_hex) and stored with restricted (600) file permissions in the user's home directory.
Audit Metadata