taste-distillation
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external tools including
ffmpeg,ffprobe, andblenderusing thesubprocessmodule. These tools are used for video processing, metadata extraction, and 3D mesh rendering, which are central to the skill's described functionality. - [EXTERNAL_DOWNLOADS]: The skill downloads generated assets such as images, videos, and 3D meshes from
fal.media, which is the media delivery domain for the well-known fal.ai platform. The implementation inscripts/taste/falapi.pyincludes a_validate_download_urlfunction that strictly enforces that downloads must use HTTPS and originate from approved fal.media hosts. - [DYNAMIC_EXECUTION]: The skill performs dynamic code generation by writing a Python script to a temporary file and executing it via
blenderto automate 3D rendering tasks. The script is constructed from a static multi-line string literal defined inscripts/taste/render3d.py. - [DYNAMIC_IMPORT]: In
scripts/taste/grade.py, the skill uses__import__to dynamically load its internaltaste.framesmodule. This is used for late-binding dependencies within specific functions and does not involve loading code from untrusted external paths.
Audit Metadata