taste

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/learn.py executes the ffmpeg utility to generate audio for its self-check demo and calls the transcribe.py script from the associated 'cut' skill via subprocess.run to process video files. These operations are integral to the skill's core functionality of learning editing habits from media.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates persistent editing rules in ~/.ai-video-editor/taste.md based on external data sources such as video transcripts and user feedback. While this creates a theoretical surface for indirect prompt injection, the risk is mitigated by the specific nature of the data extracted (timing and frequency of edits) and the implementation of data scrubbing for any suggestions shared with maintainers.
  • [EXTERNAL_DOWNLOADS]: The skill provides an option to share generalized editing rules with maintainers by opening GitHub issues using the gh CLI. This feature is transparent, requires GitHub authentication, and is only triggered after explicit user confirmation through a question box interface.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 11:17 AM