taste-distillation

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes external tools including ffmpeg, ffprobe, and blender using the subprocess module. These tools are used for video processing, metadata extraction, and 3D mesh rendering, which are central to the skill's described functionality.
  • [EXTERNAL_DOWNLOADS]: The skill downloads generated assets such as images, videos, and 3D meshes from fal.media, which is the media delivery domain for the well-known fal.ai platform. The implementation in scripts/taste/falapi.py includes a _validate_download_url function that strictly enforces that downloads must use HTTPS and originate from approved fal.media hosts.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic code generation by writing a Python script to a temporary file and executing it via blender to automate 3D rendering tasks. The script is constructed from a static multi-line string literal defined in scripts/taste/render3d.py.
  • [DYNAMIC_IMPORT]: In scripts/taste/grade.py, the skill uses __import__ to dynamically load its internal taste.frames module. This is used for late-binding dependencies within specific functions and does not involve loading code from untrusted external paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 02:52 PM
Security Audit — agent-trust-hub — taste-distillation