aliyun-qwen-tts-voice-clone
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes the official
dashscopePython library to interact with Alibaba Cloud's Model Studio APIs. References to Alibaba Cloud documentation and domains are recognized as well-known service resources. - [SAFE]: Instruction for managing the
DASHSCOPE_API_KEYfollows security best practices, recommending the use of environment variables or the standard Alibaba Cloud credentials file (~/.alibabacloud/credentials) instead of hardcoding sensitive information. - [DYNAMIC_EXECUTION]: The SKILL.md file includes a validation step that uses
py_compileto check the syntax of the skill's own scripts. This is a standard development practice and does not pose a runtime security risk. - [INDIRECT_PROMPT_INJECTION]: The skill ingests text data via the
prepare_voice_clone_request.pyscript for voice synthesis. - Ingestion points:
--textand--voice-samplearguments inprepare_voice_clone_request.py. - Boundary markers: The data is encapsulated within a structured JSON object using
json.dumps. - Capability inventory: The script performs local file writes to save the request JSON.
- Sanitization: The script uses standard JSON serialization, ensuring data integrity within the generated file.
Audit Metadata