voice-sfx-audio
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute FFmpeg commands for audio mixing and sidechain ducking. It also provides a Python script template for local audio generation using the Kokoro library.- [EXTERNAL_DOWNLOADS]: The skill references the installation of Python packages including
kokoro,soundfile, andpiper-tts, as well as the system utilityespeak-ng. It also points to reputable media sources such as Pixabay, Freesound, and Incompetech for royalty-free assets.- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes user-supplied text for narration and external audio files for mixing. - Ingestion points: Narration text passed to TTS pipelines and audio filenames used in FFmpeg commands (SKILL.md).
- Boundary markers: The instructions do not specify any delimiters or warnings to ignore instructions embedded within the text to be narrated.
- Capability inventory: Python script execution, local file system manipulation, and FFmpeg command execution across the suggested workflows.
- Sanitization: No explicit sanitization or input validation logic is provided for the text strings or file paths processed by the tools.
Audit Metadata