speak-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices by managing API credentials through environment variables (
SPEAK_API_KEY,SPEAK_APP_ID) instead of hardcoding sensitive data. - [SAFE]: The libraries utilized (@speak/language-sdk and speak_sdk) are appropriate for the service described and appear to be legitimate vendor resources.
- [SAFE]: External references are limited to reputable documentation and service sites (speak.com and openai.com).
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-submitted audio and text for tutoring purposes, which is a potential surface for indirect injection.
- Ingestion points: External data enters via
client.sendTurn,client.assessPronunciation, andsession.submitResponsewithin the TypeScript and Python examples. - Boundary markers: None are explicitly used in the provided sample code to delimit user input from instructions.
- Capability inventory: The skill performs network requests to the Speak API and accesses local files for audio recording processing.
- Sanitization: The skill relies on the underlying SDKs and backend service for data validation and sanitization.
Audit Metadata