skills/yeelight/yeelight-smart-home-skills/yeelight-interactive-light-experiences/Gen Agent Trust Hub
yeelight-interactive-light-experiences
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted visitor input that is interpolated into prompts for an external AI provider. * Ingestion points: User data is received via the /api/experience/run endpoint in scripts/server.mjs. * Boundary markers: Visitor input is serialized into JSON and appended to the prompt in scripts/lib/provider.mjs. * Capability inventory: The executor triggers light control commands through a subprocess call to the yeelight-home binary in scripts/lib/command-adapter.mjs. * Sanitization: Input values are truncated and filtered by the safeInput utility in scripts/lib/plans.mjs to limit the injection surface.
Audit Metadata