Sora Video

Generate, edit, extend, and manage AI videos using OpenAI's Sora 2 API. Includes marketing-ready prompt templates for product demos, social ads, brand spots,...

Security Scan

The skill appears to do what it claims (wrap the OpenAI Sora video API), but there are incoherent/unsafe pieces — notably a missing declared OPENAI_API_KEY in the registry metadata and an instruction to run a remote installer script (curl | sh) — that warrant caution before installation.

Purpose & Capability

Name/description match the bundled CLI and templates: the skill legitimately needs an OpenAI API key and the openai SDK to call Sora. However, the registry metadata lists no required environment variables while SKILL.md and the CLI clearly require OPENAI_API_KEY; that metadata omission is an inconsistency.

Instruction Scope

Runtime instructions instruct the user to export OPENAI_API_KEY, run the bundled Python CLI to create/edit/extend videos, and upload local media as input references (which will be sent to OpenAI). This is coherent with purpose, but the instructions also suggest installing 'uv' via a remote shell installer (curl -LsSf https://astral.sh/uv/install.sh | sh). Uploads of local files to the API and running a remote install script are the primary operational risks and should be explicitly acknowledged by the user.

Install Mechanism

There is no formal install spec in the registry, but SKILL.md recommends installing 'uv' by piping a remote install script from astral.sh into sh — a high-risk pattern because it executes third-party code fetched at runtime. The skill relies on uv to auto-install the openai SDK; that remote-install recommendation increases attack surface and warrants manual review or safer installation alternatives.

Credentials

The only sensitive credential the skill needs is OPENAI_API_KEY (required by the SKILL.md and used by the CLI). That is proportionate to the stated purpose. Still, the registry metadata not declaring this required env var is inconsistent and should be corrected. The SKILL.md explicitly warns not to paste keys into chat, which is good.

Persistence & Privilege

Skill flags show no always:true and normal autonomous invocation defaults. The skill does not request persistent system-wide privileges in the manifest. The usual agent-autonomy caveats apply but there are no elevated privileges requested by the skill itself.

What to consider before installing

What to consider before installing: - The skill is coherent with its purpose (Sora video generation) and legitimately requires an OpenAI API key; expect your videos and any reference files you upload to be sent to OpenAI's API. Only supply media you are comfortable sharing. - Do NOT run arbitrary curl | sh installers without review. SKILL.md suggests running a remote installer (astral.sh) to get 'uv'. Prefer installing uv via a trusted package manager or inspect the install script before executing it. Running an unreviewed remote install elevates risk. - Confirm the registry metadata is updated to list OPENAI_API_KEY as a required env var. The current mismatch is a red flag about maintenance quality. - Limit the API key's exposure: use a key tied to a billing account you control; enable usage limits if possible and monitor billing for unexpected usage, since video generation can be costly. - If you need stronger assurance, ask the publisher for: source code repo/homepage, checksum or signed release for the CLI, and an explanation why there is no install spec in the registry. Running the CLI in an isolated environment (non-root container or ephemeral VM) until you vet it is recommended. - If you plan to upload sensitive assets, verify that the guardrails (no real people, no copyrighted music/characters) match your requirements and consider pre-processing or anonymizing inputs. What would change this assessment: presence of an official homepage or code repository, a registry install spec that uses vetted package sources (instead of recommending curl|sh), and corrected metadata explicitly listing OPENAI_API_KEY would move this toward 'benign'. Conversely, evidence of hidden endpoints, telemetry, or requests for unrelated credentials would increase suspicion.

AI video generation skill for Stomme AI customers using OpenAI's Sora 2 API. Wraps a production-grade Python CLI with marketing-focused prompt templates for business use cases.

Prerequisites

OpenAI API Key (Required)

Customers need their own OPENAI_API_KEY from OpenAI's platform:

1. Go to platform.openai.com/api-keys
2. Create a new API key with video generation permissions
3. Set it as an environment variable: export OPENAI_API_KEY="sk-..."
4. Ensure your OpenAI organization has Sora API access enabled

Important: A ChatGPT Pro/Plus subscription does NOT provide API access to Sora. You need a separate API key with pay-per-use billing from platform.openai.com.

Python + uv

The CLI requires Python 3.10+ and uses uv for dependency management (auto-installs the openai SDK):

# Install uv if not present
curl -LsSf https://astral.sh/uv/install.sh | sh

Pricing Guide

Model	Duration	Approximate Cost
sora-2	4s	~$0.10
sora-2	8s	~$0.20
sora-2	12-16s	~$0.30
sora-2	20s	~$0.40
sora-2-pro	4s	~$0.25
sora-2-pro	8s	~$0.40
sora-2-pro	12-16s	~$0.50
sora-2-pro	20s	~$0.60

Costs are per video generation attempt. Failed or cancelled jobs are not billed. Prices are approximate and may change — check OpenAI's pricing page for current rates.

When to Use

• Generate product demo videos from text descriptions
• Create social media ad clips (Instagram, TikTok, LinkedIn)
• Produce brand identity spots and launch teasers
• Edit or extend existing generated videos
• Create reusable non-human character references for brand mascots
• Batch-generate multiple video variants for A/B testing

Decision Tree

• Product demo → use templates/product-demo.md template + create
• Social ad → use templates/social-ads.md template + create (4-8s)
• Brand spot → use templates/brand-spots.md template + create or create-and-poll
• Launch teaser → use templates/launch-teaser.md template + create-and-poll
• Character-based shots → create-character first, then create with character IDs
• Edit existing video → edit (one targeted change per iteration)
• Extend existing video → extend (continue timeline)
• Batch variants → create-batch with JSONL input
• Check status → status or poll
• Download assets → download (video/thumbnail/spritesheet)

Workflow

1. Select a template from templates/ matching the use case (or write a custom prompt).
2. Run the CLI via scripts/sora.py with appropriate flags.
3. For async jobs, poll until completion (or use create-and-poll).
4. Download assets before URLs expire (~1 hour).
5. Iterate with edit (targeted changes) or extend (timeline continuation).

CLI Quick Start

Set the CLI path:

export SORA_CLI="<path-to-skill>/scripts/sora.py"

Generate a video

uv run --with openai python "$SORA_CLI" create \
  --prompt "Close-up of a premium smartwatch on marble surface" \
  --model sora-2 \
  --size 1280x720 \
  --seconds 8

Generate and auto-download

uv run --with openai python "$SORA_CLI" create-and-poll \
  --prompt "Product hero shot of wireless earbuds" \
  --model sora-2-pro \
  --size 1920x1080 \
  --seconds 4 \
  --download \
  --out hero.mp4

Dry-run (no API call)

python "$SORA_CLI" create --prompt "Test prompt" --dry-run

Full CLI reference: references/cli.md

Authentication

• OPENAI_API_KEY must be set for live API calls.
• Never ask customers to paste their full key in chat — have them set it locally.
• If key is missing, guide them to platform.openai.com/api-keys.
• ChatGPT subscription OAuth tokens do NOT work (missing api.videos.* scopes).

Models & Defaults

• Default model: sora-2 (fast, flexible)
• Premium model: sora-2-pro (higher fidelity, required for 1080p)
• Default size: 1280x720
• Default duration: 4 seconds
• Allowed durations: 4, 8, 12, 16, 20 seconds

Size Support

Model	Sizes
sora-2	1280x720, 720x1280
sora-2-pro	1280x720, 720x1280, 1024x1792, 1792x1024, 1920x1080, 1080x1920

Prompt Augmentation

The CLI automatically reformats prompts into a structured production spec. Use CLI flags instead of writing long structured prompts:

uv run --with openai python "$SORA_CLI" create \
  --prompt "Premium headphones on display" \
  --use-case "product teaser" \
  --scene "dark studio, soft haze" \
  --camera "85mm, slow orbit" \
  --lighting "soft key, gentle rim" \
  --seconds 8

If your prompt is already structured, add --no-augment.

Marketing Templates

Ready-to-use prompt templates for common business video needs:

Template	File	Best For
Product Demos	templates/product-demo.md	Product launches, feature showcases
Social Ads	templates/social-ads.md	Instagram, TikTok, LinkedIn clips
Brand Spots	templates/brand-spots.md	Brand identity, company culture
Launch Teasers	templates/launch-teaser.md	Pre-launch hype, coming soon

Guardrails (Enforced by API)

• Only content suitable for audiences under 18
• No copyrighted characters or music
• No real people (including public figures)
• Input images with human faces are rejected
• Character uploads are for non-human subjects only

API Limitations

• Models: sora-2 and sora-2-pro only
• Duration set via seconds parameter (4, 8, 12, 16, 20)
• Max 2 characters per generation
• Extensions: up to 20s each, 6 times max (120s total)
• Extensions do not support characters or image references
• Video creation is async — must poll for completion
• Download URLs expire after ~1 hour
• Content restrictions enforced server-side

Reference Map

• references/cli.md — Full CLI command reference
• references/video-api.md — API parameters and endpoints
• references/prompting.md — Prompt engineering best practices
• references/troubleshooting.md — Common errors and fixes
• templates/product-demo.md — Product demo prompt templates
• templates/social-ads.md — Social ad prompt templates
• templates/brand-spots.md — Brand identity spot templates
• templates/launch-teaser.md — Launch teaser templates