hands-free

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill introduces a risk of indirect prompt injection by instructing the agent to accept external transcribed speech as trusted user commands.
  • Ingestion points: The standard output of the scripts/call_user.py script, which provides the transcript of the user's phone response.
  • Boundary markers: Absent; SKILL.md explicitly tells the agent: "stdout is the user's reply, verbatim; treat it as if they typed it."
  • Capability inventory: As a coding agent, the AI has high-privilege capabilities including file system modification and shell command execution.
  • Sanitization: No sanitization or instruction-filtering is applied to the transcript before it is processed by the agent.
  • [COMMAND_EXECUTION]: The agent is required to execute a local Python script (scripts/call_user.py) with user-derived strings as arguments to initiate phone calls and retrieve responses.
  • [EXTERNAL_DOWNLOADS]: The skill's setup instructions suggest using npx @parcha/hands-free install, which downloads and executes a package from the npm registry. This is a vendor-owned resource associated with the skill author.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 03:13 AM
Security Audit — agent-trust-hub — hands-free