skills/daxaur/openpaw/c-bluetooth/Gen Agent Trust Hub

c-bluetooth

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform local command-line operations using the blu utility to interact with Bluetooth hardware. These commands include listing devices (blu list), connecting to devices (blu connect), and disconnecting devices (blu disconnect).- [EXTERNAL_DOWNLOADS]: The documentation references the installation of an external dependency, blucli, via the Homebrew package manager. This is a standard practice for installing system utilities on macOS.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external data (Bluetooth device names) from the local system environment. A malicious actor could theoretically name a Bluetooth device with instructions intended to manipulate the agent's logic when it parses the output of blu list. Ingestion point: output of blu list. Boundary markers: none. Capability inventory: subprocess execution of blu commands. Sanitization: none.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 08:44 AM
Security Audit — agent-trust-hub — c-bluetooth