op55-verify
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local analysis tools including
verify.pyandmix.pyviapython3, as well assetup.mjsvianode. These scripts are used for measuring audio characteristics and validating them against technical requirements such as LUFS targets and onset timing. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files such as
music.meta.json,analysis.json, andtimeline.jsonto verify render quality against a defined score. - Ingestion points: Technical metadata and score data from
music.meta.json,analysis.json, andtimeline.jsonare ingested during the verification process. - Boundary markers: The instructions do not specify explicit delimiters for untrusted data, though the use of structured JSON and the functional nature of the analysis limits the attack surface.
- Capability inventory: The skill is restricted by the
disable-model-invocation: trueconfiguration and primarily performs read and local execution operations for analysis purposes. - Sanitization: No explicit sanitization of input metadata content is described in the provided documentation, as the tools are intended for use with trusted project-local files.
Audit Metadata