audio-video
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch audio assets from the vendor's domain
builder-items.decentraland.orgusingcurl. These downloads are used to populate the localassets/Audio/directory with media files. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates searching for environmental recordings via the Wikimedia Commons API, creating an ingestion point for untrusted data.
- Ingestion points: Metadata fields such as
LicenseShortNameandArtistretrieved fromhttps://commons.wikimedia.org/w/api.phpare processed by the agent to generate documentation in the project'sdesign/folder as described inSKILL.md. - Boundary markers: There are no boundary markers or instructions to ignore potential injection patterns within the retrieved API content.
- Capability inventory: The skill utilizes
Bashfor command execution (curl,ffmpeg,ffprobe) and file system access as described inSKILL.md. - Sanitization: No sanitization or validation of the external API metadata is specified before the data is written to files or processed.
- [COMMAND_EXECUTION]: The skill recommends using
ffmpegandffprobevia shell commands to process and validate audio files, such as converting formats or checking durations.
Audit Metadata