cutagent-edit-style-learning
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from video transcripts and project interchange formats (XML, AAF, EDL), which represents a surface for indirect prompt injection. However, the instructions focus on structured data extraction and do not suggest executing instructions found within these sources.
- [COMMAND_EXECUTION]: The skill utilizes media tools like ffmpeg and ffprobe. It explicitly includes security best practices for these operations, such as quoting user-provided paths safely and using runtime-provided executables to mitigate command injection risks.
- [DATA_EXFILTRATION]: The instructions handle potentially sensitive project metadata but include a specific safety rule to exclude private data, usernames, and tokens from the generated style profiles, effectively preventing accidental data exposure.
- [DYNAMIC_EXECUTION]: The skill contains proactive safety guidelines that forbid the execution of scripts, extensions, or macros discovered within analyzed project files, protecting the agent environment from untrusted code execution.
Audit Metadata