resolve-op55-tools
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads SoundFont (.sf2) banks from the author's GitHub and the FreePats project at freepats.zenvoid.org. The assets are verified using SHA-256 hashes to ensure integrity.
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandexecFileSyncto callffmpeg,ffprobe, andtar. These are standard tools for audio manipulation and archive extraction required for the skill's primary function. - [DYNAMIC_EXECUTION]: Uses dynamic
import()to execute music score scripts provided by the user. While this allows arbitrary code execution, it is the intended and documented design for a music rendering engine. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied audio files, JSON analysis, and timeline data (Ingestion points: scripts/render.mjs, scripts/preview.py). It has the capability to write files and execute commands (Capability inventory: subprocess calls, writeFileSync), representing a standard attack surface for media tools. Integrity checks are performed on downloaded sound banks (Sanitization: SHA-256 hashes).
Audit Metadata