skills/zapabob/skills/vrchat-osc/Gen Agent Trust Hub

vrchat-osc

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing python-osc and hermes-agent via standard package managers. These are legitimate libraries for OSC communication and the agent framework.
  • [COMMAND_EXECUTION]: Instructions include standard shell commands for package installation using pip or uv to set up the execution environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input which is relayed to the VRChat interface.
  • Ingestion points: User-provided text strings in vrchat_chatbox and values in vrchat_avatar_param.
  • Boundary markers: No specific delimiters are used to wrap the text inputs in the documentation examples.
  • Capability inventory: Network transmission of OSC messages via UDP to specified host/port.
  • Sanitization: Character length enforcement (144 characters) for chatbox input reduces the surface for complex injection attempts.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 02:51 AM