creatok-generate-video
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes the
CREATOK_API_KEYenvironment variable for API authentication. This follows the best practice of externalizing secrets rather than hardcoding credentials directly in the source code. - [SAFE]: Network operations are exclusively directed to the vendor's official domain (
https://www.creatok.ai). These requests are necessary for the skill's documented functionality: submitting video tasks and polling for status. - [SAFE]: The implementation includes a mandatory confirmation gate in both the
SKILL.mdworkflow definition and thescripts/run.jsexecution script. This ensures that no high-cost or external API calls are made without explicit user approval. - [SAFE]: File system activity is restricted to a localized
.artifactsdirectory. Thelib/artifacts.jsmodule uses relative paths and provides no mechanism for accessing or modifying sensitive system files or user directories.
Audit Metadata