cut
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration were detected. The skill operates strictly within its defined scope of video editing and local file management.
- [COMMAND_EXECUTION]: The skill executes local Ruby scripts and system commands to manage video libraries and export timelines. These commands (such as
ruby lib/buttercut/library.rb,cp,open, andexplorer) are legitimate project-specific tools used to process user media and integrate with external video editing applications. These operations are transparently disclosed in the instructions. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from video transcripts and summaries. While this represents an ingestion surface for untrusted text, the skill is designed to treat this data as editorial content (dialogue and shot descriptions) for generating structured YAML-based cut lists. The risk is minimized by the structured workflow and the use of specialized scripts for data extraction.
- Ingestion points: Video transcripts (
libraries/[library-name]/transcripts/*.json) and clip summaries (summaries/summary_*.md). - Boundary markers: The instructions provide a specific YAML schema and strict operational steps, though explicit text delimiters for transcript content are not defined.
- Capability inventory: Execution of local Ruby scripts for data processing and export, file copying to the desktop, and launching desktop applications.
- Sanitization: The agent is instructed to use specific extraction tools (
script_extractor.rb) and grep patterns, which focuses the LLM on specific data points and reduces the likelihood of embedded instructions influencing agent behavior.
Audit Metadata