skills/catoncat/vox-cli/vox/Gen Agent Trust Hub

vox

Pass

Audited by Gen Agent Trust Hub on Mar 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill automates the installation of essential system utilities including ffmpeg, portaudio, and uv using the Homebrew package manager during the bootstrap process.- [EXTERNAL_DOWNLOADS]: Installs the vox-cli package and its dependency sounddevice from the package registry or a user-provided Git repository.- [REMOTE_CODE_EXECUTION]: During initial setup, the skill fetches and executes the official Homebrew installation script directly from GitHub's infrastructure.- [COMMAND_EXECUTION]: Uses several shell scripts to encapsulate complex CLI operations, ensuring the environment meets specific hardware and software requirements before running voice pipelines.- [DATA_EXFILTRATION]: The failure logging mechanism records basic system metadata, such as the hostname and platform version, to a local file for diagnostic purposes when a command fails.- [PROMPT_INJECTION]: The skill processes untrusted audio files and text input via CLI arguments without specific boundary markers, creating a surface for indirect prompt injection. (Ingestion points: scripts/vox_cmd.sh, scripts/ensure_model.sh; Capability inventory: CLI execution and package installation; Sanitization: Uses standard shell quoting but lacks content validation).
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 7, 2026, 09:32 PM