spoken-response-desktop
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell interpolation to pass the assistant's response to the
agent-voicetool via the$RESPONSE_AS_TEXTvariable. This pattern can be exploited for command injection if the content contains shell metacharacters like backticks or subshell expansion markers, especially when enclosed in double quotes.\n- [EXTERNAL_DOWNLOADS]: The setup process requires installing theagent-voicepackage from a remote repository usinguv tool install. This package is a resource associated with the skill author.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes assistant-generated text through a shell-based capability, creating an injection surface.\n - Ingestion points: The
RESPONSE_AS_TEXTvariable is populated from the assistant's response inSKILL.md.\n - Boundary markers: No delimiters or safety instructions are provided to ensure the content does not interfere with shell command structure.\n
- Capability inventory: The skill utilizes the
agent-voiceCLI for audio synthesis and file operations as seen inSKILL.md.\n - Sanitization: There is no evidence of escaping or validation of the text before it is executed within a shell environment.
Audit Metadata