soundza
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external metadata such as sound titles, descriptions, and tags from the Soundza catalog. It proactively mitigates the risk of indirect prompt injection by instructing the agent to treat this information strictly as data and never as instructions.
- [EXTERNAL_DOWNLOADS]: As part of its primary functionality, the skill downloads audio assets from the vendor's official domain (api.soundza.com) into the local project directory. These operations are limited to the user's explicit selections.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires an API key for certain operations and correctly advises storing this sensitive information in a gitignored
.envfile, adhering to industry standards for secret management.
Audit Metadata