pipecat-friday-agent

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install standard, well-known libraries such as pipecat-ai and python-dotenv from official package registries to facilitate its core voice processing functionality.
  • [COMMAND_EXECUTION]: The skill provides a Python script to be executed locally. This script orchestrates the audio pipeline (STT, LLM, TTS) and interacts with the host's audio hardware as intended for a voice agent.
  • [PROMPT_INJECTION]: As a voice assistant, the skill inherently possesses an attack surface for indirect prompt injection via user-supplied audio input. However, the agent's capabilities are restricted to conversational response generation with no access to sensitive system commands or file operations, mitigating potential impact.
  • [SAFE]: The skill follows security best practices by utilizing environment variables for API key management and includes a custom compatibility shim for service integration rather than relying on unverified third-party binaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 02:06 PM