skills/redongreen/uspec/extract-voice/Gen Agent Trust Hub

extract-voice

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines a mechanism to generate and execute short JavaScript snippets through Figma MCP adapters (figma_execute or use_figma). This is used as an 'escape hatch' to retrieve missing metadata from Figma. The instructions strictly limit these scripts to read-only operations and under 50 lines of code, with mandatory auditing in the output JSON.- [SAFE]: The skill operates on local workspace files, specifically reading {cachePath}/{componentSlug}-_base.json and writing to {cachePath}/{componentSlug}-voice.json. It does not access sensitive system credentials or perform unauthorized network exfiltration.- [SAFE]: The 'Batch-mode contract' prevents the agent from pausing for user input or confirmation, which is a standard requirement for orchestrated agent workflows and does not represent a security bypass in this context.- [SAFE]: The skill uses referenced markdown files for accessibility patterns (VoiceOver, TalkBack, ARIA), which are internal workspace references rather than external remote downloads.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 10:10 PM
Security Audit — agent-trust-hub — extract-voice