setup-plaud-flutter

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill integrates with external hardware (Plaud recorders) to ingest device data, creating a potential surface for indirect prompt injection.
  • Ingestion points: Data enters the agent's context through PlaudSdk.onFileList and PlaudSdk.onScanResult as documented in SKILL.md and api-reference.md.
  • Boundary markers: No explicit delimiters or "ignore embedded instructions" warnings are specified for the data ingested from the external hardware devices.
  • Capability inventory: The skill includes file-write capabilities via the exportAudio method and network upload capabilities as described in the transcription flow in references/transcription-and-tokens.md.
  • Sanitization: The documentation does not specify sanitization, escaping, or validation of the data (such as file names or metadata) ingested from the external recorder.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 03:57 AM
Security Audit — agent-trust-hub — setup-plaud-flutter