sherpa-onnx-tts
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches pre-compiled runtimes and speech models from the official
k2-fsa/sherpa-onnxGitHub repository to enable offline text-to-speech functionality. - [COMMAND_EXECUTION]: Spawns the
sherpa-onnx-offline-ttsbinary usingspawnSyncto process text input into audio files. - [DYNAMIC_EXECUTION]: Manipulates environment variables (
LD_LIBRARY_PATH,DYLD_LIBRARY_PATH,PATH) at runtime to ensure the downloaded binary can correctly link to its bundled shared libraries. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text through the speech synthesis engine.
- Ingestion points: The
textargument provided via the CLI wrapper inbin/sherpa-onnx-tts. - Boundary markers: None present.
- Capability inventory: File system write access for output WAV files and subprocess execution for the TTS engine.
- Sanitization: The wrapper passes the input text as a discrete argument to the
spawnSyncfunction, which prevents shell command injection.
Audit Metadata