short-form-edit

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of video transcripts and reference reels which could contain malicious instructions designed to influence the agent's behavior during the editing process.
  • Ingestion points: Reads and reviews every spoken line from user-supplied video transcripts (SKILL.md) and analyzes reference video metadata (references/reference-analysis.md).
  • Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' markers when processing transcripts.
  • Capability inventory: The skill has the capability to write project files (DESIGN.md, OPEN-LOOPS.json), execute local Node.js scripts for validation, and interact with external APIs (Kie.ai, ElevenLabs).
  • Sanitization: No explicit sanitization or filtering of the transcript text or reference analysis is mentioned before processing.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute local Node.js scripts for quality control and validation.
  • Evidence: SKILL.md contains commands to run node .agents/skills/short-form-edit/scripts/validate-plan.mjs and node .agents/skills/short-form-edit/scripts/validate-footage.mjs.
  • Scope: These scripts perform deterministic validation of JSON schemas and file integrity (SHA256) and do not appear to have network side effects or use dangerous functions like eval().
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 01:49 PM