bx-audio
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automatically downloads the Piper text-to-speech engine and voices (approximately 148 MB) from the Rhasspy Piper project on GitHub during its first execution or via explicit installation commands.
- [EXTERNAL_DOWNLOADS]: Includes a utility function
audioFfmpegInstall()to download and configure FFmpeg, which is required for processing extended audio formats and video files. - [COMMAND_EXECUTION]: Leverages FFmpeg for media multiplexing and decoding. These operations are managed through internal BoxLang functions, with security configurations available to control the binary path.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by processing external media files and text data through its AI agent tools. It mitigates this risk by implementing path guards, resolving symlinks, and restricting file operations to the
ai.allowedPathsdirectory (defaulting to temporary and working directories).
Audit Metadata