audio-jingle
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a platform-provided CLI (node "$OD_BIN" media generate) to trigger audio generation. This command relies on system environment variables for execution.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted project metadata into shell commands without sanitization.\n
- Ingestion points: Project metadata (e.g., audioKind, voice) read in SKILL.md and README.md.\n
- Boundary markers: None identified; instructions explicitly tell the agent to use values verbatim.\n
- Capability inventory: Subprocess execution via node in SKILL.md.\n
- Sanitization: None; the skill does not specify escaping or validation of metadata before interpolation.\n- [SAFE]: No evidence of malicious behavior such as data exfiltration, persistence, or obfuscation was found in the provided files.
Audit Metadata