manage-apps-and-sounds-headless
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple external shell and TypeScript scripts (e.g.,
resolve_pushover_secret.sh,find_jingles.sh,make_custom_sound.sh,pushover_headless_web_control.ts) usingbashandbun. These scripts are located in a shared library path (skills/_lib/) outside the skill's package, introducing a dependency on unverified external code execution. - [DATA_EXFILTRATION]: The instructions explicitly command the agent to bypass network security controls by unsetting proxy environment variables (
env -u HTTPS_PROXY -u HTTP_PROXY) and usingcurl --noproxy '*'. This behavior is designed to circumvent sandboxing, network monitoring, or filtering typically found in secure environments. - [PROMPT_INJECTION]: The skill features a "Self-Evolving Skill" section that instructs the agent to "fix this file immediately," encouraging self-modification of the
SKILL.mdfile which could be exploited to persist malicious instructions. Furthermore, the skill processes untrusted data from external audio sources and the Pushover web dashboard (Ingestion points) without boundary markers or sanitization, while maintaining high-privilege capabilities such as shell execution, network access, and file writing (Capability inventory). - [CREDENTIALS_UNSAFE]: The skill retrieves sensitive login credentials (email, password, and user key) via an external resolution script and exports them as environment variables (
PO_EMAIL,PO_PW). While not hardcoded in the skill text, these secrets are exposed within the execution environment and passed to automated browser sessions.
Audit Metadata