modify-stream-deck
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes macOS system tools such as
osacompile,plutil,open, andpkillviasubprocess.runto handle application building and process management. These are standard operations for the skill's management tasks. - [DYNAMIC_EXECUTION]: The script
create_background_protocol_app.pygenerates and compiles AppleScript source code to create background URL handlers. The script implements a regex-based validation for URLs to ensure that no shell-breaking characters are injected into the generated AppleScript. - [INDIRECT_PROMPT_INJECTION]: The skill processes local Stream Deck manifest files and user specifications. It mitigates potential data-driven risks through mandatory backups, coordinate preservation checks, and a declarative dry-run process that allows for verification before any changes are applied to the system.
Audit Metadata