fish-speech
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads model checkpoints from Hugging Face (fishaudio/s2-pro) and pulls Docker images from Docker Hub (fishaudio/fish-speech), which are well-known and trusted services.
- [PROMPT_INJECTION]: The skill documents an API that ingests untrusted text and audio references, creating a surface for indirect prompt injection.
- Ingestion points: The 'input', 'ref_audio', and 'ref_text' parameters in the synthesis API calls (SKILL.md, references/api-reference.md).
- Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present in the documentation.
- Capability inventory: The documented API server can read local files via the 'file://' protocol and make network requests to fetch audio URLs.
- Sanitization: No input validation or sanitization mechanisms are described for the provided text or audio sources.
- [DATA_EXFILTRATION]: The 'ref_audio' parameter supports the 'file://' protocol for voice cloning. This is a functional feature of the model but represents a potential data exposure risk if an attacker can influence the audio reference path to point to sensitive local files.
Audit Metadata