google-speech
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
robomotionCLI tool. This includes session management, audio transcription, and speech synthesis operations. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
googlespeechpackage viarobomotion install googlespeech. This is a standard procedure for adding functionality to the vendor's CLI environment. - [CREDENTIALS_UNSAFE]: The skill mentions
ROBOMOTION_API_TOKENfor accessing vault-stored credentials. This follows best practices for secret management by utilizing environment variables rather than hardcoding sensitive information. - [PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection as it processes external audio and text data through the Google Speech APIs.
- Ingestion points: Data enters via
--audio-file,--text, and--input-patharguments inSKILL.md. - Boundary markers: None identified in the provided instructions.
- Capability inventory: The skill can execute CLI commands and interact with local and cloud storage files.
- Sanitization: No explicit sanitization or validation of the transcribed text or input text is described within the skill metadata.
Audit Metadata