audio-video

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch audio assets from the vendor's domain builder-items.decentraland.org using curl. These downloads are used to populate the local assets/Audio/ directory with media files.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates searching for environmental recordings via the Wikimedia Commons API, creating an ingestion point for untrusted data.
  • Ingestion points: Metadata fields such as LicenseShortName and Artist retrieved from https://commons.wikimedia.org/w/api.php are processed by the agent to generate documentation in the project's design/ folder as described in SKILL.md.
  • Boundary markers: There are no boundary markers or instructions to ignore potential injection patterns within the retrieved API content.
  • Capability inventory: The skill utilizes Bash for command execution (curl, ffmpeg, ffprobe) and file system access as described in SKILL.md.
  • Sanitization: No sanitization or validation of the external API metadata is specified before the data is written to files or processed.
  • [COMMAND_EXECUTION]: The skill recommends using ffmpeg and ffprobe via shell commands to process and validate audio files, such as converting formats or checking durations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:07 PM