video-storyboard
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill includes a Node.js script (
scene_plan.js) provided as a template for the user to execute locally. The script is self-contained, contains no external dependencies, and performs only mathematical calculations and JSON stringification. This constitutes a low-risk script generation pattern for utility purposes. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where untrusted user input (video descriptions and scene copy) is used to generate a structured scene plan.
- Ingestion points: User-provided descriptions of product features and video content are used to populate the shot list and JSON plan.
- Boundary markers: The skill uses a structured shot-list template to organize user input, though it lacks explicit instructions to ignore embedded commands within the user copy.
- Capability inventory: The primary capability is the generation of a JSON artifact; the provided script has no file-write, network-access, or privilege-escalation capabilities.
- Sanitization: The script performs basic sanitization on the project title by removing non-alphanumeric characters before using it as an identifier.
Audit Metadata