speak
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several MCP tools to perform text-to-speech operations, specifically
mcp__mcp-tts__google_tts,mcp__mcp-tts__openai_tts,mcp__mcp-tts__elevenlabs_tts, andmcp__mcp-tts__say_tts. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and speaks project-related content which may contain untrusted data.
- Ingestion points: Reads text from planning documents, resolved issues, and task summaries within the project files.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the text-to-speech interpolation.
- Capability inventory: The skill can perform file system operations (read/write configuration) and call external network-based TTS APIs.
- Sanitization: The skill implements a 'Text Transformation' process that removes URLs, code blocks, and long technical identifiers, which mitigates some injection vectors that rely on complex or technical strings.
- [SAFE]: Accesses project-specific and global configuration files located at
.claude/tts-config.jsonand~/.claude/respectively for persistence of voice assignments and provider status. These operations are standard for a development-focused agent skill.
Audit Metadata