silence-cut
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution by invoking
auto-editorandffprobe. These commands are used to process audio files and verify the output. - [INDIRECT_PROMPT_INJECTION]: The skill has a potential command injection surface where user-supplied inputs are interpolated into a bash command.
- Ingestion points: The skill accepts
<input>,<threshold>,<margin>, and<output>as input variables inSKILL.md. - Boundary markers: While the file paths (
<input>and<output>) are wrapped in double quotes, the<threshold>and<margin>parameters are interpolated directly into the command string without explicit quoting or sanitization. - Capability inventory: The skill possesses the capability to execute subprocesses and shell commands (specifically
auto-editorandffprobe). - Sanitization: There is no evidence of input validation, type checking, or escaping to prevent a malicious user from injecting additional shell arguments or commands via the input parameters.
Audit Metadata