earllm-build
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a PowerShell snippet for archiving project files using
Compress-Archiveand instructions to run unit tests via./gradlew test. These commands are standard for mobile app development and maintenance. - [PROMPT_INJECTION]: The application architecture described in the skill ingests external voice data, which introduces a surface for indirect prompt injection.
- Ingestion points: PCM audio data is captured from Bluetooth earbuds through
VoiceCaptureController.kt. - Boundary markers: There are no instructions provided to implement boundary markers or delimiters for the transcribed text.
- Capability inventory: The skill environment supports shell command execution and local file writing for build artifacts.
- Sanitization: The skill does not explicitly mention sanitization or validation of the speech-to-text output before it is passed to the LLM client.
Audit Metadata