skills/leonxlnx/earshot/real-sound/Gen Agent Trust Hub

real-sound

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill is designed to fetch audio assets from legitimate, well-known services such as Freesound, Mixkit, and Pixabay for use in soundtrack production.
  • The audit.py script uses urllib.request to download remote assets for the purpose of verifying that local files match the original sources (integrity checking).
  • [COMMAND_EXECUTION]: Multiple scripts (analyze.py, mix.py, master.py, mux.mjs) execute system commands via subprocess or child_process to perform audio processing and metadata extraction.
  • These calls target established utilities like ffmpeg and ffprobe using list-based arguments, which minimizes command injection risks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data, such as manifest files (audio/assets/manifests/*.json) and cue lists (out/cues.json), which influence the agent's automated design decisions.
  • Ingestion points: Ingests JSON manifests and cue files from the local project directory and remote URL references for asset verification.
  • Boundary markers: The instructions use detailed technical specifications and placeholders to delimit data, though explicit 'ignore embedded instructions' markers are absent.
  • Capability inventory: Uses subprocess.run (ffmpeg/ffprobe), urllib.request, and file system write operations.
  • Sanitization: Relies on standard Python JSON parsing and strictly defined data structures for audio parameters.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 02:29 AM