taste
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/learn.pyexecutes theffmpegutility to generate audio for its self-check demo and calls thetranscribe.pyscript from the associated 'cut' skill viasubprocess.runto process video files. These operations are integral to the skill's core functionality of learning editing habits from media. - [INDIRECT_PROMPT_INJECTION]: The skill creates persistent editing rules in
~/.ai-video-editor/taste.mdbased on external data sources such as video transcripts and user feedback. While this creates a theoretical surface for indirect prompt injection, the risk is mitigated by the specific nature of the data extracted (timing and frequency of edits) and the implementation of data scrubbing for any suggestions shared with maintainers. - [EXTERNAL_DOWNLOADS]: The skill provides an option to share generalized editing rules with maintainers by opening GitHub issues using the
ghCLI. This feature is transparent, requires GitHub authentication, and is only triggered after explicit user confirmation through a question box interface.
Audit Metadata