text-to-sfx
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official installation commands for the vendor's own packages (
pip install sonilo,npm install sonilo). These are standard installation procedures for the service's SDKs and do not involve untrusted third-party sources. - [COMMAND_EXECUTION]: The skill uses the
soniloCLI andcurlfor interacting with the Sonilo API. These commands are restricted to the vendor's official domain (api.sonilo.com) and local account management (sonilo account). - [DATA_EXPOSURE]: The skill references the use of
SONILO_API_KEYand.envfiles for credential management. It follows best practices by instructing the agent to read these from the environment or use a dedicated setup skill rather than hardcoding secrets. - [INDIRECT_PROMPT_INJECTION]: The skill ingests a user-provided
promptto generate audio. While this is an ingestion point for untrusted data, the data is passed to an external generation API and does not influence the agent's internal logic or command execution beyond the parameters of the API call.
Audit Metadata