integrate-opencut

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the cloning of the OpenCut repository from GitHub and the installation of development tools (Moon, Proto, Bun, Rust) from their respective official sources.
  • [COMMAND_EXECUTION]: Defines a mapping of developer intents to specific shell commands using the moon task runner for building, testing, and developing the project locally.
  • [INDIRECT_PROMPT_INJECTION]: As the skill interacts with external repository content, it possesses an attack surface for indirect prompt injection if the source files were compromised.
  • Ingestion points: Source code is ingested into the local environment via git clone as specified in references/integration.md.
  • Boundary markers: The skill does not use technical delimiters for repository content but provides strict guidelines on what the agent should and should not do with the data.
  • Capability inventory: The skill allows execution of build tasks (moon run) and toolchain management (proto use), which could execute logic found within the repository.
  • Sanitization: This risk is mitigated by pinning the repository to a specific, reviewed Git commit hash (4d8c49ed0706c4dc145361e01c6b1f1a87cbb863), preventing the agent from automatically pulling unvetted changes from the upstream main branch.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 08:35 PM