real-sound
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is designed to fetch audio assets from legitimate, well-known services such as Freesound, Mixkit, and Pixabay for use in soundtrack production.
- The
audit.pyscript usesurllib.requestto download remote assets for the purpose of verifying that local files match the original sources (integrity checking). - [COMMAND_EXECUTION]: Multiple scripts (
analyze.py,mix.py,master.py,mux.mjs) execute system commands viasubprocessorchild_processto perform audio processing and metadata extraction. - These calls target established utilities like
ffmpegandffprobeusing list-based arguments, which minimizes command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data, such as manifest files (
audio/assets/manifests/*.json) and cue lists (out/cues.json), which influence the agent's automated design decisions. - Ingestion points: Ingests JSON manifests and cue files from the local project directory and remote URL references for asset verification.
- Boundary markers: The instructions use detailed technical specifications and placeholders to delimit data, though explicit 'ignore embedded instructions' markers are absent.
- Capability inventory: Uses
subprocess.run(ffmpeg/ffprobe),urllib.request, and file system write operations. - Sanitization: Relies on standard Python JSON parsing and strictly defined data structures for audio parameters.
Audit Metadata