renoise-cli
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEMETADATA_POISONINGEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The author field in SKILL.md is set to 'renoise', which differs from the provided author context of 'arcocodes'.
- [EXTERNAL_DOWNLOADS]: The skill relies on external scripts located in a relative sibling directory ('../renoise-setup/') to install and verify the 'renoise' binary, which is a core dependency not contained within the skill itself.
- [COMMAND_EXECUTION]: Automated preflight checks execute shell commands to modify the system environment ('PATH') and run local utility scripts using node, bash, and python.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface through user-provided prompts and media files used for video generation. While the skill relies on server-side validation, the ingestion of untrusted data constitutes an attack surface.
- Ingestion points: Prompts are read from project JSON files and media analysis is performed on local files.
- Boundary markers: The skill uses '--prompt-file' to handle input via files or stdin, which reduces shell injection risks compared to direct arguments.
- Capability inventory: The skill can read/write local files and execute the renoise CLI for network uploads.
- Sanitization: Relies on the external CLI and server-side API for content moderation and safety filtering.
Audit Metadata