buzz-media-attachments
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute system tools including
ffmpegfor video transcoding,ffprobefor metadata extraction, and a specializedbuzzCLI for message delivery. - [CREDENTIALS_UNSAFE]: The workflow requires reading sensitive configuration data from
~/.hermes/.env. This file contains authentication tokens such asBUZZ_AUTH_TAGandBUZZ_PRIVATE_KEY. - [DATA_EXFILTRATION]: The skill accesses
~/.hermes/logs/gateway.logto extract channel identifiers from live message logs, which involves processing potentially sensitive chat history data. - [PROMPT_INJECTION]: The skill has an indirect injection surface by ingesting data from external log files. 1. Ingestion points:
~/.hermes/logs/gateway.loginSKILL.md. 2. Boundary markers: Absent. 3. Capability inventory:subprocess.run,ffmpeg,buzzCLI inSKILL.md. 4. Sanitization: Absent.
Audit Metadata