voice-to-me

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/voice_to_me.py utilizes the subprocess module to invoke ffmpeg for audio enhancement tasks like denoising and appending silence. The implementation is secure as it uses argument lists and avoids shell=True, preventing shell injection vulnerabilities within the script itself.
  • [EXTERNAL_DOWNLOADS]: The skill declares a dependency on edge-tts, a well-known Python library that communicates with Microsoft's Edge TTS service to synthesize speech.
  • [SAFE]: The skill includes several security and stability best practices:
  • Input text is limited to 20,000 characters to prevent resource exhaustion.
  • Numeric arguments such as --rate and --tail-silence are range-validated.
  • The output file is restricted to the .mp3 extension to prevent arbitrary file overwrites.
  • Regex filtering is applied to input text to strip internal gateway tags (<qqvoice>, etc.) before synthesis.
  • [DATA_EXFILTRATION]: While the skill can read local files via the --text-file argument, this is a core functional requirement for processing long text inputs. The risk is mitigated by the script's specific focus on generating audio output rather than transmitting file contents to arbitrary remote servers (other than the trusted TTS provider).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 03:12 PM
Security Audit — agent-trust-hub — voice-to-me