Security risk report for @forgecat/openai_skills_sora v0.0.11
Source Integrity
Low
Profile is sourced from OpenAI's official repository (https://github.com/openai/skills) with a specific commit hash and Apache-2.0 license.
Metadata includes author attribution, version tracking, and original repository reference, enabling supply-chain verification.
No typosquatted dependencies or attacker-controlled package names detected.
Agent Intent
Low
Content is a legitimate Sora video generation skill with standard prompting guidance, CLI documentation, and reference templates.
No instructions to ignore system prompts, exfiltrate credentials, read sensitive files, or hide instructions.
Guidance on prompt augmentation, character continuity, and iterative refinement is standard creative direction, not poisoning.
References to network access and sandbox approvals are transparent operational notes, not attempts to manipulate the agent into bypassing security controls.
Details
Evidence
"Never ask the user to paste the full key in chat. Ask them to set it locally and confirm when ready."
"Prefer the bundled CLI and never modify scripts/sora.py unless the user asks."
"Use case: cinematic shot" and structured prompt templates are standard creative briefs, not malicious instructions.
Permissions
PRM-000Medium
Skill requires network access (web_fetch) to call the OpenAI Video API and download generated assets; this is appropriate for its stated function.
CLI invokes Python scripts and uses `uv` package manager, which is standard for dependency management but introduces subprocess execution.
File operations are scoped to local output directories (download videos, write JSON responses); no unrestricted filesystem mutation or deletion.
Authority is somewhat broader than minimal (network + subprocess + file write), but justified by the video generation and asset management workflow.
Details
Evidence
"Real API calls require network access and OPENAI_API_KEY."
"uv run --with openai python \"$SORA_CLI\" create ..." — subprocess execution via uv.
"Download URLs expire after about 1 hour; copy assets to your own storage." — file write for downloaded content.
MCP Risk
Low
No MCP servers are declared in the profile; the skill uses the OpenAI Python SDK directly via the bundled CLI script.
The bundled CLI (`scripts/sora.py`) is a known, versioned artifact from OpenAI's official repository, not an arbitrary binary.
Network access is scoped to the OpenAI Video API endpoint; no unrestricted external host access or full filesystem exposure.
Environment variable requirements (OPENAI_API_KEY, optional UV_CACHE_DIR) are minimal and documented.
Details
Evidence
"No MCP servers defined" — no MCP risk surface.
"Original repository: https://github.com/openai/skills" — official source.
"Use uv run --with openai python \"$SORA_CLI\" ..." — dependency management via official SDK.
ForgeCat