voice-interface-builder
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard boilerplate for Speech Recognition and Text-to-Speech functionality. No malicious patterns, such as prompt injection, data exfiltration, or unauthorized command execution, were identified. The implementation follows standard frontend practices for accessibility.
- [INDIRECT_PROMPT_INJECTION]: The skill implements voice command detection that processes untrusted voice-to-text transcripts, establishing an attack surface for indirect prompt injection.
- Ingestion points: The
useSpeechRecognitionhook inSKILL.mdingests external audio transcripts converted to text. - Boundary markers: Absent in the provided command-matching logic.
- Capability inventory: Navigation (
router.push) and UI state management (setMenuOpen). - Sanitization: Limited to
toLowerCase()normalization.
Audit Metadata