hume
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Utilizes
curlto perform HTTP requests to the Hume AI REST API andjqto parse the resulting JSON data.- [EXTERNAL_DOWNLOADS]: Retrieves data from official Hume AI API endpoints (api.hume.ai), including emotional analysis results, batch job artifacts, and synthesized audio files.- [PROMPT_INJECTION]: Identifies a potential surface for indirect prompt injection. The skill fetches external content, such as chat transcripts and emotion analysis predictions, from the Hume API. If the input media or text processed by Hume contains malicious instructions, they could be ingested by the agent during subsequent analysis of the API output. - Ingestion points:
SKILL.md(via API calls to endpoints such as/v0/batch/jobs/{job-id}/predictionsand/v0/evi/chats/{chat-id}) - Boundary markers: None provided in the command output handling
- Capability inventory: Network access via
curl, file writes to/tmpdirectory - Sanitization: No explicit sanitization or filtering of the API response content is performed within the skill commands.
Audit Metadata