iopho-audio-director
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8). It ingests data from storyboards, context files, and user-provided audio files (SKILL.md) without using boundary markers or sanitization logic. This could allow malicious instructions in those files to influence the agent's behavior during planning or execution.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run ffmpeg and python3 (SKILL.md). These operations use parameters like file paths and durations sourced from project files, which requires careful handling to prevent command injection.
- [NO_CODE]: The analysis feature in SKILL.md depends on a script 'scripts/analyze_audio.py' that is not included in the provided files. Consequently, its operations and its interaction with the '--gemini' flag cannot be verified for security.
Audit Metadata