taste-engine
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a structured framework for visual style analysis and design rule extraction. The provided Python scripts are focused on validating and merging JSON data related to these design profiles.
- [DYNAMIC_EXECUTION]: The regression test scripts (test_taste_lint.py and test_taste_merge.py) utilize importlib.util to dynamically load the main logic scripts from local paths. This is a standard practice for unit testing in Python environments and does not involve remote code or untrusted paths.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON files through its linting and merging scripts. 1. Ingestion points: sys.argv[1] in scripts/taste_lint.py, and --memory and --spec arguments in scripts/taste_merge.py. 2. Boundary markers (absent): No explicit instructions to ignore embedded content within the JSON fields. 3. Capability inventory: scripts/taste_merge.py can write output to a user-provided file path. 4. Sanitization (present): Uses standard JSON parsing (json.loads) which prevents structural injection.
Audit Metadata