create-speech-recording-controls
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the agent-voice CLI tool from the author's repository using the uv tool manager.
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to store user-provided or user-influenced content in a variable that is subsequently executed in a shell command string (agent-voice speak "$RESPONSE_AS_TEXT"). This presents a command injection vulnerability if the input is not properly sanitized.
- Ingestion points: User-supplied text, summaries, and table data provided in the skill instructions (SKILL.md).
- Boundary markers: The instructions lack markers or specific directives to escape shell metacharacters.
- Capability inventory: The skill leverages the agent-voice CLI tool to perform system-level actions.
- Sanitization: No input validation or sanitization steps are defined for the handled text.
Audit Metadata