skills/ynginkim/op55/op55-verify/Gen Agent Trust Hub

op55-verify

Pass

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local analysis tools including verify.py and mix.py via python3, as well as setup.mjs via node. These scripts are used for measuring audio characteristics and validating them against technical requirements such as LUFS targets and onset timing.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files such as music.meta.json, analysis.json, and timeline.json to verify render quality against a defined score.
  • Ingestion points: Technical metadata and score data from music.meta.json, analysis.json, and timeline.json are ingested during the verification process.
  • Boundary markers: The instructions do not specify explicit delimiters for untrusted data, though the use of structured JSON and the functional nature of the analysis limits the attack surface.
  • Capability inventory: The skill is restricted by the disable-model-invocation: true configuration and primarily performs read and local execution operations for analysis purposes.
  • Sanitization: No explicit sanitization of input metadata content is described in the provided documentation, as the tools are intended for use with trusted project-local files.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 2, 2026, 09:37 AM