pipecat-friday-agent
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install standard, well-known libraries such as
pipecat-aiandpython-dotenvfrom official package registries to facilitate its core voice processing functionality. - [COMMAND_EXECUTION]: The skill provides a Python script to be executed locally. This script orchestrates the audio pipeline (STT, LLM, TTS) and interacts with the host's audio hardware as intended for a voice agent.
- [PROMPT_INJECTION]: As a voice assistant, the skill inherently possesses an attack surface for indirect prompt injection via user-supplied audio input. However, the agent's capabilities are restricted to conversational response generation with no access to sensitive system commands or file operations, mitigating potential impact.
- [SAFE]: The skill follows security best practices by utilizing environment variables for API key management and includes a custom compatibility shim for service integration rather than relying on unverified third-party binaries.
Audit Metadata