spoken-response-controls
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a command-line utility,
agent-voice, from a remote source on GitHub using theuvtool manager. - [COMMAND_EXECUTION]: The skill executes shell commands that interpolate assistant-generated text into command arguments, specifically in the command
agent-voice speak "$RESPONSE_AS_TEXT". This pattern is susceptible to command injection if the generated text contains shell metacharacters like backticks or subshell syntax. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by processing untrusted assistant output and passing it to system-level commands without sanitization.
- Ingestion points: The assistant's generated response content serves as the input for the
$RESPONSE_AS_TEXTvariable inSKILL.md. - Boundary markers: No delimiters or safety instructions are present to ensure that the content is treated strictly as data and not as executable commands.
- Capability inventory: The skill possesses shell execution capabilities through the calling of the
agent-voiceutility. - Sanitization: There is no evidence of character escaping or sanitization logic to handle malicious payloads within the interpolated variables.
Audit Metadata