dreamina-canvas-generate-audio
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data by interpolating it into the
--promptargument for thedreamina-canvasCLI tool. - Ingestion points: The skill accepts user-provided text for both text-to-speech (TTS) and music generation modes in
SKILL.md. - Boundary markers: Absent. The instructions do not specify delimiters or guidelines to ignore embedded instructions within the user-supplied prompt string.
- Capability inventory: The skill utilizes the
dreamina-canvasCLI tool to perform audio node creation and editing, as described inSKILL.mdandreferences/audio-node-contract.md. - Sanitization: Absent. There are no instructions for sanitizing, escaping, or validating the input before passing it to the CLI execution environment.
- [COMMAND_EXECUTION]: The skill facilitates the execution of local CLI commands (
dreamina-canvas) to manage audio nodes. While these are legitimate tool invocations, the instructions detail the correct syntax for node creation, editing, and discovery (e.g.,voice list,model search).
Audit Metadata