google-speech

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the robomotion CLI tool. This includes session management, audio transcription, and speech synthesis operations.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the googlespeech package via robomotion install googlespeech. This is a standard procedure for adding functionality to the vendor's CLI environment.
  • [CREDENTIALS_UNSAFE]: The skill mentions ROBOMOTION_API_TOKEN for accessing vault-stored credentials. This follows best practices for secret management by utilizing environment variables rather than hardcoding sensitive information.
  • [PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection as it processes external audio and text data through the Google Speech APIs.
  • Ingestion points: Data enters via --audio-file, --text, and --input-path arguments in SKILL.md.
  • Boundary markers: None identified in the provided instructions.
  • Capability inventory: The skill can execute CLI commands and interact with local and cloud storage files.
  • Sanitization: No explicit sanitization or validation of the transcribed text or input text is described within the skill metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 10:21 AM
Security Audit — agent-trust-hub — google-speech