cutagent-cli
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local command-line tool named
cutagentto inspect and modify DaVinci Resolve projects. It executes various subcommands and uses the--jsonflag to parse results programmatically. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect instructions embedded in processed data.
- Ingestion points: The agent reads data from
cutagentcommand outputs, local reference JSON files, and project-specific metadata (timelines, clips, and media states) as described inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' directives to prevent the agent from following instructions hidden in media metadata.
- Capability inventory: The skill uses a tool capable of performing mutations on project files and editing media states.
- Sanitization: There are no instructions or scripts provided for sanitizing or validating external metadata content before it enters the agent context.
Audit Metadata