speech-to-text
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes documentation and examples for using
curlto interact with the Each Labs API endpoint athttps://eachsense-agent.core.eachlabs.run/v1/chat/completions. This is the intended mechanism for the transcription service. - [EXTERNAL_DOWNLOADS]: The skill facilitates the processing of audio and video content hosted at external URLs provided by the user to the transcription API.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes untrusted audio and video content from external URLs which could contain malicious verbal instructions.
- Ingestion points: External URLs for audio and video files in the
image_urlsparameter in SKILL.md. - Boundary markers: Absent.
- Capability inventory: Use of
Bash(curl)andWebFetchfor API interaction. - Sanitization: No explicit sanitization or filtering of transcribed content is mentioned.
Audit Metadata