generate-voice-guide
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches public post data from social media platforms using well-known Apify actors like
apidojo/twitter-user-tweets-scraperandharvestapi/linkedin-profile-posts. This process requires the user to provide anAPIFY_API_TOKENenvironment variable to authenticate with the service.\n- [COMMAND_EXECUTION]: Performs file system operations to create and update directories and files within the~/.goose-skills/path. This includes saving structured markdown voice guides and updating a centralconfig.jsonto allow other skills to locate and use the generated guides.\n- [PROMPT_INJECTION]: The skill ingests and processes untrusted text from external social media profiles, creating a potential surface for indirect prompt injection if the source content contains instructions designed to influence the agent.\n - Ingestion points: Public posts from X and LinkedIn profiles scraped via Apify actors in Phase 1.\n
- Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore' instructions for the content being analyzed.\n
- Capability inventory: The skill possesses the ability to write to the local filesystem and make network requests via the Apify API.\n
- Sanitization: No explicit sanitization or filtering logic is described for the scraped content prior to its analysis by the language model.
Audit Metadata