skills/buddyh/agent-skills/alexa-cli/Gen Agent Trust Hub

alexa-cli

Pass

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct users to install the alexacli binary from the developer's GitHub repository (github.com/buddyh/alexa-cli) using brew install or go install. These are vendor-owned resources.
  • [COMMAND_EXECUTION]: The skill relies on executing the alexacli system command to perform its operations, which is the primary intended functionality.
  • [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it ingests untrusted data (voice history and Alexa responses) from external Alexa devices into the agent's context.
  • Ingestion points: alexacli ask and alexacli history (SKILL.md).
  • Boundary markers: None identified in instructions.
  • Capability inventory: The agent has the ability to execute Alexa commands, control smart home devices, and run routines via the alexacli tool.
  • Sanitization: No explicit sanitization or filtering of Alexa output is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 23, 2026, 11:00 PM