audio-extraction
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runand shell scripts to executeffmpeg,ffprobe, andyt-dlpfor media processing. The Python code correctly uses list-based argument passing, which is a security best practice to prevent shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill automates downloading media from external URLs and RSS feeds. It recommends installing reputable Python packages (
eyeD3,mutagen,feedparser,requests,gpodder) to support these operations. - [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection by parsing data from external RSS feeds.
- Ingestion points:
download_podcast_episodesfunction inSKILL.md(RSS URL parameter). - Boundary markers: None.
- Capability inventory:
subprocess.run(ffmpeg),requests.get(media download), and file system write. - Sanitization: Media titles are sanitized via alphanumeric filtering to prevent path traversal when creating files.
Audit Metadata