modify-stream-deck

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes macOS system tools such as osacompile, plutil, open, and pkill via subprocess.run to handle application building and process management. These are standard operations for the skill's management tasks.
  • [DYNAMIC_EXECUTION]: The script create_background_protocol_app.py generates and compiles AppleScript source code to create background URL handlers. The script implements a regex-based validation for URLs to ensure that no shell-breaking characters are injected into the generated AppleScript.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes local Stream Deck manifest files and user specifications. It mitigates potential data-driven risks through mandatory backups, coordinate preservation checks, and a declarative dry-run process that allows for verification before any changes are applied to the system.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 02:00 PM