audio-mix
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local script located at
skills/shared/scripts/audio_mix.pyusing the Python interpreter. This script is used to perform audio mixing tasks such as ducking and SFX overlay. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audio data from external files, which could potentially contain malicious instructions or malformed metadata intended to exploit the processing logic. 1. Ingestion points: Audio files provided as inputs for voice, background music, and sound effects in
SKILL.md. 2. Boundary markers: None present in the skill instructions to separate data from commands. 3. Capability inventory: Subprocess execution viapythonfor audio processing tasks as seen in the execution steps. 4. Sanitization: No explicit sanitization or validation of the input audio files is described in the provided instructions.
Audit Metadata