text-to-speech
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local command-line utilities to perform its core functions.
pipeline.pyandchunk_and_rewrite.pyexecute theclaudeCLI to rewrite text sections via an LLM.kokoro_round5.pyandinject_chapters.pycallffmpegfor converting raw audio to MP3 and managing ID3 chapter metadata.inject_chapters.pycontains a self-test function that generates temporary audio files usingffmpeg.- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it interpolates user-provided text into LLM prompts for narrative rewriting.
- Ingestion points: The input markdown file is read in
pipeline.pyandchunk_and_rewrite.py. - Boundary markers: The system prompts use
---SOURCE---delimiters to separate instructions from input text, but do not explicitly instruct the model to ignore any commands found within the source. - Capability inventory: The skill can execute local commands (
claude,ffmpeg) and write to the local file system. - Sanitization: No specific sanitization or filtering is applied to the input markdown before it is sent to the LLM.
Audit Metadata