Skills
Navigate
skills/jeremylongshore/tons-of-skills-marketplace/speak-sdk-patterns/Gen Agent Trust Hub

speak-sdk-patterns

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The preprocessAudio function pattern in SKILL.md uses execSync to invoke the ffmpeg binary using a shell string template. This method is susceptible to command injection if the inputPath variable is derived from untrusted user input and contains shell metacharacters.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents a code pattern that establishes a vulnerability surface for untrusted data (file paths) that could be used by an agent to generate insecure code.
  • Ingestion points: The inputPath and outputPath parameters in the preprocessAudio function in SKILL.md.
  • Boundary markers: None present in the code snippet to validate or delimit the input paths.
  • Capability inventory: The skill references shell execution tools including execSync (Node.js) in SKILL.md and subprocess.run (Python) in references/code-patterns.md.
  • Sanitization: The TypeScript pattern lacks input validation or shell-escaping for the variables interpolated into the command string.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:49 AM