Kubrick is a local, stdlib-first Hermes skill. It does not require network access, API keys, or privileged installation for core creative work.
| Surface | Trust | Notes |
|---|---|---|
Local CLI (scripts/kubrick.py) |
Trusted operator | Caller controls project files |
Optional MCP (kubrick_do) |
Untrusted args | Intent/action allowlisted; flags validated; paths bounded |
| Continuity Forge / model / vision APIs | Optional external | Never required; adapters are syntax-only |
Pattern corpus (references/, schemas/) |
Read-only at runtime | Ordinary operators must not mutate these trees |
references/usage/ and out/ |
Mutable overlays | Cache, receipts, and project outputs only |
- Set
KUBRICK_PROJECT_DIRto pin the project root (defaults to cwd). - Reads may come from the project root or the skill root (examples, schemas, references).
- Writes must stay inside the project root or skill
out//references/usage/. - Writes into
references/(exceptusage/),schemas/,scripts/,skills/,.git, and core contract files are rejected.
Structured YAML/JSON intake is rejected when it exceeds 2_000_000 bytes before parse.
YAML loading uses yaml.safe_load only.
install.sh / install.ps1 stage under $HERMES_HOME, validate before activation,
swap atomically, and keep backups outside the skills discovery tree. They do not
download remote payloads.
Local outputs are PROPOSED or OBSERVATION. Weak or contradictory evidence returns
NOT_COMPUTABLE. Corpus confidence and Forge canon are never auto-mutated by Kubrick.
Report security issues privately to the repository owner. Do not open public issues for exploitable path/MCP bypasses before a fix is available.