volcengine-doubao-speech-tts
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a documentation and best-practices guide for Volcengine's speech services. It includes explicit warnings against logging secrets (e.g., 'Never log secrets, tokens, enrollment audio, or sensitive source text') and provides guidance on secure credential handling by referencing environment variables (e.g., '${VOLC_ACCESS_KEY}').
- [EXTERNAL_DOWNLOADS]: The skill references official Volcengine documentation domains (docs.volcengine.com) and the research repository ArXiv. These are recognized as legitimate documentation sources for the stated service and do not escalate the verdict.
- [PROMPT_INJECTION]: No evidence of instructions designed to override agent safety filters or bypass system constraints was found. The instructions are focused on API boundaries and protocol selection.
- [DATA_EXFILTRATION]: There is no code that reads sensitive local files (like SSH keys or AWS configs) for external transmission. The network operations described are limited to the official service endpoints (openspeech.bytedance.com) for the purpose of speech synthesis.
- [CREDENTIALS_UNSAFE]: No hardcoded API keys or tokens are present. The skill uses standard placeholders and recommends using environment variables for sensitive configuration.
Audit Metadata