C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Design & media
drama-skills
开源 AI 短剧/漫剧创作 skill 合集：剧本、角色资产、分镜 storyboard、图片/视频提示词、审查，适配 Claude Code 与 Codex | Open-source AI short drama / micro-drama skills for Claude Code & Codex: script, assets, storyboard, image & video prompts, review. MIT.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 39/100
- Rank
- #347 of 500
- GitHub stars
- 3k
What it does
Drama-Skills is an open-source collection of AI agent capabilities for creating short-form and micro-drama content, including script generation, character asset management, storyboard composition, and image/video prompt engineering. It integrates with Claude Code and Codex to streamline the entire creative workflow from concept through review.
Who it’s for
Content creators, indie producers, and AI builders seeking structured tools for rapid short-drama production. Teams using Claude-based agents who want modular, reusable components for storytelling automation.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/zenstory-ai/drama-skills (opens external site) for the latest installation instructions. As a skill collection rather than an npm package, integration typically involves cloning the repository and configuring it as a custom skill or MCP server within your Claude Code or Codex environment. Consult the repository's documentation for Claude Desktop mcpServers JSON configuration or direct integration patterns.
Risks
- No clear API key or credential management documented; verify that prompts and external service calls do not leak sensitive data
- Prompt injection risk if user-provided scripts or character descriptions are directly interpolated into LLM calls without sanitization
- Data exfiltration risk if generated assets (scripts, images, videos) are sent to third-party APIs without explicit user consent
- Maintenance and supply-chain risk: repository shows strong GitHub engagement (2933 stars) but zero npm downloads suggests limited production adoption and potential for abandoned dependencies
- Image/video generation prompts may inadvertently encode biases or unsafe content if review mechanisms are bypassed or incomplete
How to stay secure
Least-privilege permissions
- Limit API keys and access tokens: Only generate the minimum API credentials needed for image and video generation services. Rotate them monthly and delete unused keys immediately.
- Restrict file access: The skill should only read scripts and character descriptions you explicitly upload—not scan your entire system or access other folders without permission.
- Control third-party integrations: Review which external services (image generators, video tools) the skill connects to, and disable any you don't actively use.
Network isolation
- Require explicit approval before sending data outside: The skill must ask permission before uploading scripts, images, or videos to external services—never send automatically in the background.
- Use secure connections only: Verify that all communication with image/video APIs uses encrypted (HTTPS/TLS) connections, never plain text.
- Separate production and testing: Keep your real scripts and creative assets on an isolated device or account, separate from testing environments.
Monitoring
- Log all external API calls: Request activity logs showing what data was sent, when, and to which services—review monthly for unexpected activity.
- Audit generated content: Regularly sample the scripts, images, and videos produced to verify they match your requests and contain no injected code or unexpected changes.
- Track dependency updates: Set up notifications if the skill's underlying libraries or dependencies receive security patches, and apply updates within 2 weeks.
Red flags to watch for
- Unusual API costs or quota usage: Spikes in third-party API charges may indicate the skill is making unauthorized calls or generating content without your knowledge.
- Scripts containing prompt injections: If user-submitted character descriptions or storylines suddenly change the skill's behavior or produce off-topic output, stop using it immediately.
- Requests for credentials or payment info: The skill should never ask you to paste API keys, passwords, or sensitive personal data directly into prompts.
- Generated content with bias, safety issues, or watermarks you didn't request: This signals review mechanisms may be broken or the skill is using unauthorized training data.
Alternatives
- Synthesia or HeyGen – commercial platforms with built-in safety guardrails for video content generation
- RunwayML – AI video editing and generation tool with native content moderation
- Descript – narrative-focused content creation with AI scripting and asset management
- Custom LLM prompting pipelines using OpenAI or Anthropic APIs with your own guardrails