songsee
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
songseeutility using the commandgo install github.com/steipete/songsee/cmd/songsee@latest, which downloads source code from a public GitHub repository. - [COMMAND_EXECUTION]: The skill documents the use of the
songseecommand to read audio files and write image files (PNG/JPG) to the local filesystem. It also supports piped input fromcatand mentions the optional use offfmpegfor audio decoding. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audio files to generate visual representations intended for analysis by vision models, creating a potential (though low-risk) injection surface.
- Ingestion points: Audio files (WAV, MP3, etc.) ingested by the
songseecommand as described inSKILL.md. - Boundary markers: None identified in the skill instructions.
- Capability inventory: Execution of external binaries (
songsee,ffmpeg,cat) and file system read/write access for audio and image files. - Sanitization: No specific sanitization or validation of the input audio data is performed before visualization generation.
Audit Metadata