relay
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for utilizing the
relaymessengerCLI for agent management and includes code for spawningffmpegsubprocesses viaasyncio.create_subprocess_execto handle video tracks in calls. The command usage is restricted to the skill's documented functionality and follows established development patterns. - [EXTERNAL_DOWNLOADS]: The instructions reference installing the
relaymessengerpackage and the@relaymessenger/sdkfrom official registries. It also utilizes well-known libraries such aspipecat-aifor voice provider integration. - [INDIRECT_PROMPT_INJECTION]: The skill consumes untrusted data through incoming message events (
message.received) and user reviews (rating.created). - Ingestion points:
references/agent-events.mdandreferences/build-an-agent.mddescribe handling inbound WebSocket events. - Boundary markers: The skill explicitly instructs the agent to treat all incoming labels, values, and review text as untrusted data rather than instructions.
- Capability inventory: The provided code references have capabilities for file system writes (storing chat IDs), network operations (Relay API), and subprocess execution (
ffmpeg). - Sanitization: The instructions emphasize that the agent must treat external content as data and never as commands.
Audit Metadata