skills/vinitu/macos-tv-skill/macos-tv/Gen Agent Trust Hub

macos-tv

Pass

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes osascript commands to interface with the macOS TV.app. These operations are limited to the app's automation dictionary for playback control (play, pause, seek) and library management (list movies, search tracks), which is the intended and safe use for this skill.
  • [PROMPT_INJECTION]: An indirect prompt injection surface is present as the skill ingests metadata (e.g., movie titles and artist names) from the local TV library and returns it to the agent context. While this data is untrusted, the skill's capabilities are restricted to media control. 1. Ingestion points: scripts/library/movies.applescript, scripts/library/tv-shows.applescript, scripts/track/current.applescript. 2. Boundary markers: Absent in the script output. 3. Capability inventory: Local osascript execution for TV.app control. 4. Sanitization: None performed on the retrieved metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 13, 2026, 07:02 PM