voice-to-me
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/voice_to_me.pyutilizes thesubprocessmodule to invokeffmpegfor audio enhancement tasks like denoising and appending silence. The implementation is secure as it uses argument lists and avoidsshell=True, preventing shell injection vulnerabilities within the script itself. - [EXTERNAL_DOWNLOADS]: The skill declares a dependency on
edge-tts, a well-known Python library that communicates with Microsoft's Edge TTS service to synthesize speech. - [SAFE]: The skill includes several security and stability best practices:
- Input text is limited to 20,000 characters to prevent resource exhaustion.
- Numeric arguments such as
--rateand--tail-silenceare range-validated. - The output file is restricted to the
.mp3extension to prevent arbitrary file overwrites. - Regex filtering is applied to input text to strip internal gateway tags (
<qqvoice>, etc.) before synthesis. - [DATA_EXFILTRATION]: While the skill can read local files via the
--text-fileargument, this is a core functional requirement for processing long text inputs. The risk is mitigated by the script's specific focus on generating audio output rather than transmitting file contents to arbitrary remote servers (other than the trusted TTS provider).
Audit Metadata