fable-video
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
scripts/fetch_models.pyto download model weights and motion capture data. These downloads are restricted to trusted and well-known services including GitHub and Hugging Face over HTTPS, with built-in host validation to prevent unauthorized connections. - [COMMAND_EXECUTION]: The skill executes local Python scripts (
vendor/vimax/main_idea2video.py,vendor/ai4animation/Demos/Program.py) and Node.js commands (npx remotion render) to perform video rendering and character animation tasks. This is standard behavior for a video production toolset. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (ideas, scripts, novels) to generate video shot descriptions.
- Ingestion points: User text input via
idea2video,script2video, andnovel2videoworkflows mentioned inSKILL.md. - Boundary markers: Includes a explicit instruction to treat vendored code and research notes as data, not instructions.
- Capability inventory: Executes local Python/Node scripts and calls external video generation APIs.
- Sanitization: Relies on internal prompting logic and the stated data/instruction separation rule.
- [SAFE]: The skill adheres to credential safety by explicitly prohibiting the hardcoding of API keys and requiring them to be provided via environment variables or user configuration.
Audit Metadata