openai-realtime-voice
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill explicitly warns against exposing standard API keys in client-side environments. It correctly recommends maintaining API keys on a trusted server and using short-lived ephemeral credentials for client-side sessions.
- [EXTERNAL_DOWNLOADS]: All external references target official OpenAI documentation or trusted libraries. No suspicious downloads or remote script executions were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risks associated with processing untrusted audio and transcript data. It provides robust mitigation strategies, such as server-side validation of tool arguments, requiring explicit user confirmation for side-effecting tools, and implementing safety boundaries for high-impact decision-making.
- [DATA_EXFILTRATION]: No patterns indicative of data exfiltration were found. The skill emphasizes data minimization, redaction of sensitive information, and clear consent for audio capture.
- [COMMAND_EXECUTION]: Code examples use standard libraries for networking and web services. No arbitrary command execution or shell injection vulnerabilities were detected.
Audit Metadata