hands-free
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill introduces a risk of indirect prompt injection by instructing the agent to accept external transcribed speech as trusted user commands.
- Ingestion points: The standard output of the
scripts/call_user.pyscript, which provides the transcript of the user's phone response. - Boundary markers: Absent;
SKILL.mdexplicitly tells the agent: "stdout is the user's reply, verbatim; treat it as if they typed it." - Capability inventory: As a coding agent, the AI has high-privilege capabilities including file system modification and shell command execution.
- Sanitization: No sanitization or instruction-filtering is applied to the transcript before it is processed by the agent.
- [COMMAND_EXECUTION]: The agent is required to execute a local Python script (
scripts/call_user.py) with user-derived strings as arguments to initiate phone calls and retrieve responses. - [EXTERNAL_DOWNLOADS]: The skill's setup instructions suggest using
npx @parcha/hands-free install, which downloads and executes a package from the npm registry. This is a vendor-owned resource associated with the skill author.
Audit Metadata