text-to-speech
Warn
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The bash script example provided for batch processing is vulnerable to command injection. Evidence: In the 'Batch Text-to-Speech' section, the script interpolates the
$TEXTvariable directly into a shell command payload ("content": "... $TEXT"). If the input text contains shell metacharacters such as backticks or command substitution syntax, the shell will execute them during command assembly. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with an external speech synthesis service. Evidence: The instructions specify sending user data to
https://eachsense-agent.core.eachlabs.run/v1/chat/completionsusing tools likecurlor theopenaiPython SDK.
Audit Metadata