sora — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sora (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
OpenCode mirror: sourced from ~/.config/opencode/skills/sora and mirrored for OpenCode CLI usage.Creates or manages short video clips for the current project (product demos, marketing spots, cinematic shots, UI mocks). Defaults to sora-2 and a structured prompt augmentation workflow, and prefers the bundled CLI for deterministic runs. Note: $sora is a skill tag in prompts, not a shell command.
--use-case, --scene, --camera, etc.) instead of pre-writing a structured prompt. If you already produced a structured prompt file, pass --no-augment to avoid double-wrapping.scripts/sora.py) with sensible defaults (see references/cli.md). For long prompts, prefer --prompt-file to avoid shell-escaping issues; pair with --no-augment if the prompt is already structured.prompt.txt, remix_job.json, temp JSONL). If the sandbox blocks rm, skip cleanup or truncate the files without surfacing an error.OPENAI_API_KEY must be set for live API calls.If the key is missing, give the user these steps:
OPENAI_API_KEY as an environment variable in their system.sora-2 (use sora-2-pro for higher fidelity).1280x720.4 (allowed: "4", "8", "12" as strings).openai package); do not use raw HTTP.OPENAI_API_KEY before any live API call.UV_CACHE_DIR=/tmp/uv-cache.scripts/sora.py unless the user asks.Audio: and Dialogue: lines and keep it short.sora-2 and sora-2-pro.seconds parameter.seconds as a string enum ("4", "8", "12").references/video-api.md for the supported sizes).Reformat prompts into a structured, production-oriented spec. Only make implicit details explicit; do not invent new creative requirements.
Template (include only relevant lines):
Use case: <where the clip will be used>
Primary request: <user's main prompt>
Scene/background: <location, time of day, atmosphere>
Subject: <main subject>
Action: <single clear action>
Camera: <shot type, angle, motion>
Lighting/mood: <lighting + mood>
Color palette: <3-5 color anchors>
Style/format: <film/animation/format cues>
Timing/beats: <counts or beats>
Audio: <ambient cue / music / voiceover if requested>
Text (verbatim): "<exact text>"
Dialogue:
<dialogue>
- Speaker: "Short line."
</dialogue>
Constraints: <must keep/must avoid>
Avoid: <negative constraints>Augmentation rules:
--no-augment to avoid the tool re-wrapping it.Use case: product teaser
Primary request: a close-up of a matte black camera on a pedestal
Action: slow 30-degree orbit over 4 seconds
Camera: 85mm, shallow depth of field, gentle handheld drift
Lighting/mood: soft key light, subtle rim, premium studio feel
Constraints: no logos, no textPrimary request: same shot and framing, switch palette to teal/sand/rust with warmer backlight
Constraints: keep the subject and camera move unchangedUse these modules when the request is for a specific artifact. They provide targeted templates and defaults.
references/cinematic-shots.mdreferences/social-ads.mdreferences/cli.mdreferences/video-api.mdreferences/prompting.mdreferences/sample-prompts.mdreferences/troubleshooting.mdreferences/codex-network.mdscripts/sora.py.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.