callsmith

Pass

Audited by Gen Agent Trust Hub on Jun 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The installation script (install-callsmith.sh) and README recommend installing dependencies using curl | bash patterns. These target well-known utilities (Fast Node Manager) and the author's own repository, which is common for developer tooling.
  • [COMMAND_EXECUTION]: The CLI tool performs multiple shell executions during project lifecycle commands, including project initialization, testing, and dependency management (e.g., npm, pytest, uv). These are functionally necessary for a code generator.
  • [EXTERNAL_DOWNLOADS]: The tool fetches provider configuration packs (JSON) and documentation from GitHub and community registries. These operations are required to keep the local tool synchronized with current voice AI provider metadata.
  • [PROMPT_INJECTION]: The tool includes a robust validation boundary for user-supplied data (e.g., provider identifiers in answers.json). It uses regex validation (/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/) and control-character stripping to prevent code injection in generated Python files and prompt injection in generated Markdown files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 29, 2026, 06:06 PM