cartesia-sonic
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill provides legitimate guidance for API integration and adheres to safety best practices.
- [CREDENTIALS_UNSAFE]: The skill promotes safe secret management by explicitly advising against embedding API keys in client-side code and suggesting the use of server-side trusted environments and access tokens.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted LLM transcripts for speech generation. 1. Ingestion points: Transcripts in TTS API requests (SKILL.md). 2. Boundary markers: Recommends terminal punctuation and spelling tags. 3. Capability inventory: Network requests to Cartesia voice APIs. 4. Sanitization: Advises constraining LLM output to plain prose without markdown.
- [EXTERNAL_DOWNLOADS]: The skill references official Cartesia documentation links, which are legitimate and safe resources for the described service implementation.
Audit Metadata