generate-cues
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
edge-ttsPython library to communicate with Microsoft's neural TTS service for audio generation. This involves connecting to a well-known service provided by Microsoft to perform its primary function. - [COMMAND_EXECUTION]: Utilizes
Bashto perform file management, invoke the Python interpreter, and run audio processing utilities such asffmpeg,ffprobe, andespeak-ng. These operations are standard for the skill's purpose and are limited by the configuration's allowed tools. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it accepts user-provided text via the
--cuesand--voicearguments and processes them into shell commands. While used for audio synthesis, malicious input could theoretically attempt to escape the command context. - Ingestion points:
--cuesand--voicearguments inSKILL.md. - Boundary markers: None provided for the interpolated arguments.
- Capability inventory: Extensive file and command access via
Bash(mkdir, ffmpeg, python, espeak-ng, rm, mv). - Sanitization: The skill implements filename slugging in its Python rendering script, though the shell-based iteration over the cue list lacks explicit escaping logic.
Audit Metadata