edgespeak-align

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external media files and transcript text, which constitutes an ingestion surface for untrusted data.
  • Ingestion points: Media file paths and transcript text (passed via string or file) are used as inputs for the edgespeak-cli align command in SKILL.md.
  • Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the provided transcript text.
  • Capability inventory: The skill utilizes subprocess execution for the edgespeak-cli and supports file system writes using the -o output flag.
  • Sanitization: No sanitization or validation of the transcript content is described in the skill instructions.
  • [EXTERNAL_DOWNLOADS]: The skill documentation includes a link to the official vendor documentation for CLI installation at https://edgespeak.com/docs/cli#install. The instructions explicitly state that the user should execute the installation command rather than the agent doing so automatically.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 09:28 AM