pipecat
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The documentation describes a framework for building real-time bots that ingest untrusted user data (streaming audio and text) to drive LLM-powered actions and tool calls. This architectural pattern possesses an inherent attack surface for indirect prompt injection.
- Ingestion points: Untrusted user input enters the pipeline through transport processors (e.g.,
transport.input()) and STT transcription frames. - Boundary markers: While the framework standardizes on universal context models like
LLMContext, the documentation does not specify mandatory boundary delimiters or sanitization for raw user audio/text fragments. - Capability inventory: The framework supports extensive capabilities including server-side function calling, MCP tool integration, and cloud-based deployment operations which could be targetable via malicious input.
- Sanitization: The instructions focus on secure secret management (keeping API keys server-side) rather than explicit input sanitization of the multimodal streams.
Audit Metadata