bx-ai-audio
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides functions such as
aiTranscribe()andaiTranslate()that ingest data from external sources, including URLs and local file paths. This represents an inherent surface for indirect prompt injection if the processed audio contains malicious instructions. The skill author mitigates this by providing remediation guidance in the documentation, such as capping text length and whitelisting providers. - [SAFE]: The skill promotes secure credential management by instructing developers to use environment variables (e.g.,
OPENAI_API_KEY,CARTESIA_API_KEY) or system settings rather than hardcoding API keys in source code. - [SAFE]: The documentation includes defensive coding patterns for streaming callbacks, specifically recommending that developers monitor for client disconnections and return
falseto terminate provider generation, preventing resource exhaustion and unnecessary API costs.
Audit Metadata