generate-cues

Pass

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the edge-tts Python library to communicate with Microsoft's neural TTS service for audio generation. This involves connecting to a well-known service provided by Microsoft to perform its primary function.
  • [COMMAND_EXECUTION]: Utilizes Bash to perform file management, invoke the Python interpreter, and run audio processing utilities such as ffmpeg, ffprobe, and espeak-ng. These operations are standard for the skill's purpose and are limited by the configuration's allowed tools.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it accepts user-provided text via the --cues and --voice arguments and processes them into shell commands. While used for audio synthesis, malicious input could theoretically attempt to escape the command context.
  • Ingestion points: --cues and --voice arguments in SKILL.md.
  • Boundary markers: None provided for the interpolated arguments.
  • Capability inventory: Extensive file and command access via Bash (mkdir, ffmpeg, python, espeak-ng, rm, mv).
  • Sanitization: The skill implements filename slugging in its Python rendering script, though the shell-based iteration over the cue list lacks explicit escaping logic.
Audit Metadata
Risk Level
SAFE
Analyzed
May 7, 2026, 09:14 PM
Security Audit — agent-trust-hub — generate-cues