sweep
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is exposed to indirect prompt injection from external contributors. 1. Ingestion points: Slack messages, GitHub issues, and Emails (references/sources/). 2. Boundary markers: Plans include mandatory 'Untrusted customer content' blocks (references/plan-template.md). 3. Capability inventory: Uses Bash, gh, and git. 4. Sanitization: Implements regex validation for Git references and a sensitive flag for content redaction.
- [COMMAND_EXECUTION]: Executes shell commands via git, gh, ffmpeg, and ffprobe. Evidence: scripts/analyze_riffrec_zip.py and SKILL.md. Mitigation: Strict validation of user-provided Git references in Phase 2f prevents command injection.
- [EXTERNAL_DOWNLOADS]: Downloads media and content from user-configured feedback platforms. Evidence: Phase 2e and source personas. Mitigation: The sensitive flag in configuration ensures private content is not stored.
- [DATA_EXFILTRATION]: Transmits media data to OpenAI for transcription. Evidence: scripts/analyze_riffrec_zip.py. Mitigation: Functionality is documented and can be suppressed for sensitive sources.
Audit Metadata