media-osc
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runto execute a local Python script (scripts/oscctl.py) that manages the binary wire format and network communication for the OSC protocol. This is a standard pattern for providing project-specific tooling. - [DATA_EXFILTRATION]: The script performs network operations using the
socketmodule to send and receive UDP and TCP packets. It also reads local files via thebundlecommand to transmit structured payloads. These features are core to the skill's primary purpose as a network controller. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface through the
dumpandpingcommands, which listen for and display data received from remote network sources. - Ingestion points: Network data received via
s.recvfromin thecmd_dumpandcmd_pingfunctions withinscripts/oscctl.py. - Boundary markers: None. Received data is printed to the agent's context as JSON-formatted text.
- Capability inventory: The script can read local files and perform outbound network communication.
- Sanitization: Binary messages are parsed using the
structmodule; strings are decoded witherrors="replace"and then serialized to JSON before being presented to the agent.
Audit Metadata