text-to-speech
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Python subprocess module to interface with system utilities such as ffmpeg and espeak-ng. These interactions are performed using list-based argument passing, which effectively mitigates the risk of command injection by avoiding shell interpretation.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of standard Python and system packages from official registries and enables the download of pre-trained neural models from Hugging Face. These operations involve well-known technology platforms and follow standard procedures for establishing a functional audio processing environment.
- [INDIRECT_PROMPT_INJECTION]: As the skill is designed to process arbitrary text for audio synthesis, it inherently possesses an indirect prompt injection surface. The ingestion points include the input text for the TTS functions, and while basic sanitization is performed to remove formatting characters, no specialized security boundaries are implemented to isolate the content. Given the specific utility and limited capabilities of the skill, this risk is assessed as low.
Audit Metadata