translate-and-dub
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits media data to the vendor's API (api.sync.so) and manages a corresponding API key. The documentation specifically instructs the user to keep the key secure and out of chat logs, which is a standard security practice.- [REMOTE_CODE_EXECUTION]: The instructions reference the installation and use of official Sync.so SDKs and the Sync.so MCP server via npx. These are trusted resources provided by the skill's authoring organization.- [COMMAND_EXECUTION]: The documentation includes example shell commands using wc and ffprobe for local asset processing. These are routine operations for managing media files.- [INDIRECT_PROMPT_INJECTION]: The skill processes external media files, creating a potential attack surface for instructions embedded in audio or video tracks.
- Ingestion points: Media assets provided through local files, URLs, or social media links.
- Boundary markers: None identified in the provided skill files.
- Capability inventory: Includes tool calls for media generation and shell utilities for file inspection and transfer.
- Sanitization: The skill relies on the vendor's backend processing for media handling without explicit client-side sanitization.
Audit Metadata