configure
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform routine environment management tasks. This includes creating the plugin's configuration directory (~/.bitwize-music/), backing up existing configuration files toconfig.yaml.bak, and deleting the configuration file upon a user-initiated reset. These actions are transparently documented and occur entirely within the user's home directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input via the
AskUserQuestiontool and command arguments to populate theconfig.yamlfile. While this ingestion of untrusted data (such as artist names or custom paths) into a persistent file creates a theoretical surface for indirect prompt injection, the risk is mitigated by the structured YAML format and the interactive human-in-the-loop workflow required to update the settings.
Audit Metadata