tts-voice-synthesis

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes content from external text files via the --text_file argument in scripts/tts_generate.py. Ingestion points: The --text_file parameter in scripts/tts_generate.py. Boundary markers: Absent; the script reads raw file content into the synthesis pipeline. Capability inventory: Includes file reading (open), audio file writing (torchaudio.save), and execution of local synthesis scripts. Sanitization: Absent; input text is processed without filtering or validation of embedded instructions.- [EXTERNAL_DOWNLOADS]: Fetches model weights and configuration from Hugging Face (huggingface.co), which is a well-known service for machine learning models. The skill uses huggingface-cli and git clone to retrieve assets from repositories managed by fishaudio, 2noise, and FunAudioLLM.- [COMMAND_EXECUTION]: The skill executes shell commands for environment preparation, such as directory creation (mkdir -p), and runs Python scripts to perform audio processing tasks. This is consistent with the primary purpose of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 01:21 AM
Security Audit — agent-trust-hub — tts-voice-synthesis