skills/zkmake/skills/optimize-audio/Gen Agent Trust Hub

optimize-audio

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands including ffmpeg, ffprobe, ls, and cp to inspect and process audio files. These commands are necessary for the skill's primary function of audio compression and format conversion.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection because it processes external files whose names or metadata are controlled by the user or external sources. If an agent interpolates these filenames into shell commands without proper quoting or escaping, it could lead to command injection.
  • Ingestion points: Filenames and audio metadata processed by ffprobe and ffmpeg in SKILL.md.
  • Boundary markers: Absent; the instructions do not specify using delimiters for filename variables.
  • Capability inventory: Includes file system inspection (ls), metadata extraction (ffprobe), file processing (ffmpeg), and file copying (cp).
  • Sanitization: The instructions do not explicitly mandate shell-safe quoting for the <file> placeholders.
  • [EXTERNAL_DOWNLOADS]: The skill checks for ffmpeg and recommends installation via well-known and trusted package managers such as Homebrew (brew), APT (apt), and Winget, or the official ffmpeg.org website. This is documented as a preflight check and relies on the user to perform the installation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 01:25 PM