alexa-cli
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct users to install the
alexaclibinary from the developer's GitHub repository (github.com/buddyh/alexa-cli) usingbrew installorgo install. These are vendor-owned resources. - [COMMAND_EXECUTION]: The skill relies on executing the
alexaclisystem command to perform its operations, which is the primary intended functionality. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it ingests untrusted data (voice history and Alexa responses) from external Alexa devices into the agent's context.
- Ingestion points:
alexacli askandalexacli history(SKILL.md). - Boundary markers: None identified in instructions.
- Capability inventory: The agent has the ability to execute Alexa commands, control smart home devices, and run routines via the
alexaclitool. - Sanitization: No explicit sanitization or filtering of Alexa output is mentioned.
Audit Metadata