tts-voice-synthesis
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes content from external text files via the
--text_fileargument inscripts/tts_generate.py. Ingestion points: The--text_fileparameter inscripts/tts_generate.py. Boundary markers: Absent; the script reads raw file content into the synthesis pipeline. Capability inventory: Includes file reading (open), audio file writing (torchaudio.save), and execution of local synthesis scripts. Sanitization: Absent; input text is processed without filtering or validation of embedded instructions.- [EXTERNAL_DOWNLOADS]: Fetches model weights and configuration from Hugging Face (huggingface.co), which is a well-known service for machine learning models. The skill useshuggingface-cliandgit cloneto retrieve assets from repositories managed by fishaudio, 2noise, and FunAudioLLM.- [COMMAND_EXECUTION]: The skill executes shell commands for environment preparation, such as directory creation (mkdir -p), and runs Python scripts to perform audio processing tasks. This is consistent with the primary purpose of the skill.
Audit Metadata