ai-voice-cloning
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external repositories and documentation for CLI installation and extended functionality.
- Directs users to install the 'belt' CLI using
npx skills add belt-sh/cli. - Links to external installation documentation hosted at
https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md. - Recommends adding related skills from the
inference-sh/skillsrepository. - [COMMAND_EXECUTION]: The skill utilizes the
beltCLI tool to execute voice generation and media processing tasks. - Provides numerous examples of executing
belt app runwith various AI models (e.g.,infsh/kokoro-tts,inworld/text-to-speech-2). - Uses shell redirection to manage and store output files (e.g.,
> speaker1.json). - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it interpolates user-controlled data into tool commands.
- Ingestion points: User-provided strings are directly embedded into the JSON payload of the
beltcommand via the--inputargument (specifically the 'prompt' and 'text' fields). - Boundary markers: The instructions lack explicit boundary markers or security delimiters to isolate user-supplied content from the execution context.
- Capability inventory: The skill is authorized for
Bash(belt *)operations, enabling command execution and file system writes based on generated output. - Sanitization: There is no evidence of input validation or sanitization to prevent malicious instructions embedded in the input text from influencing agent behavior.
Audit Metadata