together-audio
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and scripts recommend installing the 'together', 'websockets', and 'together-ai' packages. These are standard, well-known dependencies required for interacting with the Together AI platform.
- [PROMPT_INJECTION]: The skill processes untrusted audio data from local files or remote URLs. 1. Ingestion points: 'scripts/stt_transcribe.py' and 'scripts/stt_transcribe.ts' accept audio input for transcription. 2. Boundary markers: Absent; transcribed text is not isolated with delimiters. 3. Capability inventory: The skill has file-writing capabilities via 'response.write_to_file' and Node.js 'fs'. 4. Sanitization: Absent; transcription output is not sanitized before being returned to the agent context. This represents a standard surface for indirect prompt injection common to audio-to-text workflows.
Audit Metadata