handcrafted-voice-audit
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is well-structured, documentation is thorough, and all components (markdown and Python) are legitimate for its stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill explicitly implements a 'Golden Rule' to treat all fetched pages, uploaded files, and pasted text as data, never instructions. It specifically instructs the assistant to detect and report instructions within data rather than executing them (Workflow Step 5).
- [COMMAND_EXECUTION]: The skill utilizes a local script
scripts/voice_scan.py. Analysis of this script shows it is restricted to regex-based text processing and standard file reading. It uses no dynamic execution functions (e.g., eval, exec) and performs no network operations. - [EXTERNAL_DOWNLOADS]: No remote scripts, external package managers (npm, pip), or remote code executions were detected. The skill uses only standard Python libraries.
- [DATA_EXFILTRATION]: There are no network-capable commands or functions. The skill processes data locally and returns results directly to the user/agent interface.
- [OBFUSCATION]: No obfuscated content, multi-layer encoding, or hidden Unicode patterns were identified in any of the skill files.
Audit Metadata