archival-fragments

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill guides the agent to execute a sequence of shell commands using ffmpeg, ffprobe, libtv, and curl to manage the video assembly and external service interactions.- [EXTERNAL_DOWNLOADS]: The skill downloads media assets from well-known services, specifically api.fish.audio and URLs provided by the LibTV CLI for image and video generation.- [DYNAMIC_EXECUTION]: The skill uses embedded Python scripts (via python3 -c and heredocs) to automate complex project management tasks and dynamically calculate parameters for ffmpeg command generation based on runtime data.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided ideas and scripts which are subsequently used to generate model prompts and narrative audio.
  • Ingestion points: User input for film concepts and narration scripts as described in references/01-script.md.
  • Boundary markers: The skill relies on formatting templates but does not implement technical delimiters or specific instructions to neutralize potential prompt injections within the user text.
  • Capability inventory: The skill has the ability to write to the local file system, access external network resources (via curl), and execute shell commands (libtv, ffmpeg, python3).
  • Sanitization: No sanitization or validation of user-provided strings is mentioned before they are interpolated into the workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 05:52 AM
Security Audit — agent-trust-hub — archival-fragments