Skills
Navigate
skills/jeremylongshore/tons-of-skills-marketplace/deepgram-cost-tuning/Gen Agent Trust Hub

deepgram-cost-tuning

Fail

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides code snippets that use child_process.execSync to execute shell commands like ffprobe and ffmpeg. The variable inputPath is interpolated directly into these commands (\"${inputPath}\") without shell escaping or sanitization, allowing for arbitrary command execution if the filename contains shell metacharacters.- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through malicious filenames.
  • Ingestion points: The inputPath variable in the measureSavings function (SKILL.md) and the reduceDuration function (references/implementation.md).
  • Boundary markers: None are present to delimit untrusted filenames from shell commands.
  • Capability inventory: The skill uses child_process.execSync and interacts with system tools (ffmpeg, ffprobe) while having file system write capabilities.
  • Sanitization: The skill performs no escaping or validation on file paths before using them in shell-executed strings.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 9, 2026, 03:44 AM