skills/openfilm/skills/vintage-film/Gen Agent Trust Hub

vintage-film

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use npx openfilm get to retrieve music files. This command invokes a package associated with the skill's author and is a core part of its media processing functionality.- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where malicious instructions could be embedded in processed image metadata.
  • Ingestion points: SKILL.md specifies reading metadata (dates, locations) from user-provided photos and clips.
  • Boundary markers: The instructions strictly limit the agent to factual data usage, forbidding guessing or extending data, which serves as a logical constraint.
  • Capability inventory: The skill can execute npx commands, write rendered clips to a local assets/ directory, and use web platform libraries.
  • Sanitization: The agent is constrained to specific darkroom-style operations (crop, scale, color), which inherently limits the impact of malicious content in metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 03:48 PM