suggest-sfx
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run local Python tools (
tools/gen_sfx.pyandtools/mix_sfx.py) to handle audio generation and mixing within the repository environment. - [EXTERNAL_DOWNLOADS]: The skill integrates with the ElevenLabs Sound Effects API to acquire audio clips. This represents an interaction with a well-known service, and the skill correctly directs the agent to use an API key stored in a .env file for authentication.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local project files.
- Ingestion points: The agent reads timing and visual data from
beats.json,catalog.json,palette.json, and React source files (.tsx). - Boundary markers: A mandatory 'USER-AUDIT GATE' is enforced, requiring the agent to print a cue sheet and obtain explicit user approval before mixing.
- Capability inventory: The agent utilizes Python scripts that have the ability to write to the file system and make network requests.
- Sanitization: While automated sanitization is not detailed, the workflow relies on the human audit gate to verify all proposed actions and sound placements.
Audit Metadata