atet
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
atetCLI from the author's GitHub repository and may fetch verified tools like VTracer and tldraw Offline. These processes are documented to use version pinning and SHA-256 verification as described inreferences/install.md. - [COMMAND_EXECUTION]: The skill facilitates media manipulation and diagram rendering through the
atetCLI and specialized Bun scripts, such asscripts/compose-rubber-stamp-field-note.ts. These commands are used for deterministic layout, image vectorization, and video editing. - [INDIRECT_PROMPT_INJECTION]: The skill processes external media files which could contain embedded instructions.
- Ingestion points: Untrusted media is processed for transcription (
atet ai transcribe) and analysis (atet analyze speech), as seen inreferences/gateway-media.mdandreferences/video-projects.md. - Boundary markers: The skill relies on structural constraints like "strict JSON" inputs and "Follow the prompt literally" instructions to maintain focus and prevent accidental obedience to data-embedded commands.
- Capability inventory: The skill possesses file system access, network capabilities for media generation, and the ability to execute its own local scripts and CLI tools.
- Sanitization: Utilizes model capability checks, typed inputs, and a "Code Mode" that requires manual scaffold review rather than executing arbitrary AI-generated logic.
Audit Metadata