Skills
Navigate
skills/delorenj/skills/cartesia-line-voice-agent/Gen Agent Trust Hub

cartesia-line-voice-agent

Fail

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The documentation instructs users to install the Cartesia CLI using a high-risk shell-piping pattern.
  • Evidence: curl -fsSL https://cartesia.sh | sh in SKILL.md.
  • [COMMAND_EXECUTION]: The mcp_tool feature allows agents to execute arbitrary local commands on the host system.
  • Evidence: Examples in SKILL.md and references/tool-patterns.md demonstrate executing commands like npx -y @modelcontextprotocol/server-memory.
  • [INDIRECT_PROMPT_INJECTION]: The skill architecture creates an attack surface for indirect prompt injection by processing untrusted caller speech and providing the agent with tools that can perform network operations.
  • Ingestion points: VoiceAgentApp and LlmAgent process real-time user-supplied audio and text.
  • Capability inventory: The agent has access to web_search, http_server_tool (webhooks), and mcp_tool (local commands).
  • Boundary markers: Examples show standard prompt structures but do not require explicit delimiters or sanitization for untrusted data.
  • Sanitization: Not explicitly implemented in the provided agent logic.
  • [EXTERNAL_DOWNLOADS]: The skill fetches code and configuration from external sources that are not on the trusted organization list.
  • Evidence: Downloads from https://cartesia.sh and instructions to install external packages like ddgs.
Recommendations
  • HIGH: Downloads and executes remote code from: https://cartesia.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 4, 2026, 06:55 AM
Security Audit — agent-trust-hub — cartesia-line-voice-agent