skills/eugene-ee/affaan-m-ecc/taste/Gen Agent Trust Hub

taste

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator for multiple video production tools (FFmpeg, Remotion, Fal.ai) and ingests external project notes to generate shot plans and prompts, creating a surface for indirect instructions. The project notes are used to map aesthetics and sequence shots, which could be exploited to inject instructions into downstream generation and composition steps.
  • Ingestion points: External 'project notes' referenced in the 'Beat-Mapped Shot Plan' section are used to define the production logic.
  • Capability inventory: The skill executes shell commands via FFmpeg and npx remotion, and interacts with external image/video generation APIs.
  • Boundary markers: The instructions lack explicit delimiters or 'ignore' directives to separate user project data from agent instructions.
  • Sanitization: No sanitization or validation logic is specified for external inputs before they are interpolated into prompt templates or shell commands.
  • [COMMAND_EXECUTION]: The skill provides specific FFmpeg recipes and Remotion render commands to be executed in the terminal for video processing, cropping, and composition.
  • Evidence: Multiple FFmpeg command snippets and an 'npx remotion render' command are provided in the 'FFmpeg Recipes' and 'Remotion Composition Skeleton' sections of SKILL.md.
  • [DYNAMIC_EXECUTION]: The skill generates a React-based composition script (Remotion) at runtime by adapting a provided skeleton with beat-synced sequences and dynamic asset paths.
  • Evidence: The 'Remotion Composition Skeleton' section provides a TypeScript React template intended for dynamic population and execution via the Remotion CLI.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 03:41 PM
Security Audit — agent-trust-hub — taste