fish-audio-api

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches audio synthesis and generated images from Fish Audio and OpenAI official REST API endpoints. The skill pins these URLs and restricts custom endpoints to local loopback addresses during testing to prevent unauthorized network requests.\n- [COMMAND_EXECUTION]: The documentation describes running Node.js scripts for narration generation and CLI-based image generation tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied text for text-to-speech and image generation tasks.\n
  • Ingestion points: User-provided text strings in the synthesizeOne function and prompt strings in the generateImages function within scripts/public-media-api.cjs.\n
  • Boundary markers: None identified; the skill relies on the safety guardrails implemented by the downstream API providers.\n
  • Capability inventory: Executes network POST operations to specific external APIs and performs local file system writes for audio (WAV) and image (PNG) assets.\n
  • Sanitization: Implements validation of response integrity, including RIFF/WAVE verification and PNG magic byte checks, and uses an atomic write mechanism for file output. It also includes a rejectCredentials function that recursively scans configuration objects to prevent accidental credential leakage in local project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 07:50 PM