sound-design
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates secure credential handling by explicitly advising against hardcoding API keys. It implements a robust lookup mechanism that prioritizes environment variables and local environment files (.env) at the project root.
- [COMMAND_EXECUTION]: Multiple scripts utilize FFmpeg and FFprobe for audio analysis and processing. Technical review confirms these tools are invoked via safe subprocess execution patterns (passing arguments as arrays), which effectively prevents shell injection vulnerabilities despite processing user-defined file paths.
- [EXTERNAL_DOWNLOADS]: The skill facilitates communication with the ElevenLabs API for audio generation. This is a well-known and legitimate service, and no evidence of unauthorized or untrusted remote code execution was found.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests user-supplied text to generate audio prompts, it includes heuristic checks to prevent ToS violations and provides clear instructions for prompt construction. The risks associated with processing these prompts are negligible as the system output is limited to non-executable audio formats.
Audit Metadata