renoise-cli
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates several local media processing tasks by executing system tools and vendor-provided scripts.
- The
qc-preview.shandsplit-grid.shscripts useffmpegandImageMagickfor stitching videos and splitting storyboard grids. material-ingest.mjsandbatch-generate.shutilize the localrenoiseCLI for media analysis, uploads, and sequential task management.- Commands are called with specific, controlled arguments and do not present signs of arbitrary shell injection.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain instructions aimed at influencing the agent's behavior.
- Ingestion points: The skill reads
project.json,material-pool.json, and processes user-supplied media files across various scripts includinggenerate-preview.mjsandanalyze-beats.py. - Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the processed project files.
- Capability inventory: The skill has the capability to execute local binaries (
renoise,ffmpeg,magick) and write files to the local filesystem. - Sanitization: The skill uses standard JSON parsing and file handling libraries but does not implement additional sanitization for natural language fields that might be interpreted as instructions.
- [EXTERNAL_DOWNLOADS]: The skill references external dependencies and installation scripts required for its operation.
- The documentation suggests installing well-known Python libraries such as
librosa,soundfile, andnumpyfor audio processing. - It provides instructions for installing the Renoise CLI via a script located in a sibling vendor directory (
../renoise-setup/scripts/install-cli.mjs). - These references target reputable tools and the vendor's own setup infrastructure.
Audit Metadata