c-bluetooth
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform local command-line operations using the
bluutility to interact with Bluetooth hardware. These commands include listing devices (blu list), connecting to devices (blu connect), and disconnecting devices (blu disconnect).- [EXTERNAL_DOWNLOADS]: The documentation references the installation of an external dependency,blucli, via the Homebrew package manager. This is a standard practice for installing system utilities on macOS.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external data (Bluetooth device names) from the local system environment. A malicious actor could theoretically name a Bluetooth device with instructions intended to manipulate the agent's logic when it parses the output ofblu list. Ingestion point: output ofblu list. Boundary markers: none. Capability inventory: subprocess execution ofblucommands. Sanitization: none.
Audit Metadata