video-scriptwriting
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes instructions to list the contents of specific directories (e.g., ~/.claude/skills/) to detect installed companion skills. This directory scanning is limited to the agent's own environment and is used for recommending related tools.
- [EXTERNAL_DOWNLOADS]: The documentation and skill instructions suggest using npx to install additional skills from the developer's repository. These downloads are part of the intended extension ecosystem and originate from the skill's own vendor.
- [PROMPT_INJECTION]: The skill processes extensive user input through an interview framework, creating a surface for indirect prompt injection.
- Ingestion points: User responses provided during the multi-category interview process described in references/interview-questions.md.
- Boundary markers: Absent. The agent is not instructed to use specific delimiters or to ignore potential instructions embedded in user answers.
- Capability inventory: The agent is authorized to perform directory listings and file operations required for script generation and revision.
- Sanitization: There are no instructions to sanitize or validate user-provided strings before they are interpolated into the final YAML script output.
Audit Metadata