optimize-audio
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands including
ffmpeg,ffprobe,ls, andcpto inspect and process audio files. These commands are necessary for the skill's primary function of audio compression and format conversion. - [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection because it processes external files whose names or metadata are controlled by the user or external sources. If an agent interpolates these filenames into shell commands without proper quoting or escaping, it could lead to command injection.
- Ingestion points: Filenames and audio metadata processed by
ffprobeandffmpeginSKILL.md. - Boundary markers: Absent; the instructions do not specify using delimiters for filename variables.
- Capability inventory: Includes file system inspection (
ls), metadata extraction (ffprobe), file processing (ffmpeg), and file copying (cp). - Sanitization: The instructions do not explicitly mandate shell-safe quoting for the
<file>placeholders. - [EXTERNAL_DOWNLOADS]: The skill checks for
ffmpegand recommends installation via well-known and trusted package managers such as Homebrew (brew), APT (apt), and Winget, or the officialffmpeg.orgwebsite. This is documented as a preflight check and relies on the user to perform the installation.
Audit Metadata