cuento-reel
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several local Python scripts to manage the voice design, avatar invention, video generation, and reel composition (e.g.,
python3 .cursor/skills/avatar-invent/scripts/invent_avatar.py). It also usesffmpegfor video and audio processing tasks like re-muxing clips to prevent A/V drift. - [DYNAMIC_EXECUTION]: The workflow relies on the runtime generation and execution of complex JSON configuration files (
plan.json,storyboard.json,voice_brief.json). These files define the logic and parameters for the local Python orchestration scripts. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content in the form of stories, tales, and character dialogue provided by the user.
- Ingestion points: User-supplied story text, beat sheets (
episodio.script.md), and narration scripts. - Boundary markers: No explicit safety delimiters or instruction-bypass warnings are defined for the ingested text.
- Capability inventory: The system writes files (MP3, MP4, JSON), executes local Python scripts, and interacts with external generative AI APIs (MiniMax, ElevenLabs, Gemini).
- Sanitization: There is no mention of sanitizing or escaping the user-provided story content before it is interpolated into scripts or API calls.
Audit Metadata