speak-summary
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted text data provided by the user or other skills to generate audio output.
- Ingestion points: The
tts.shscript accepts an<input.txt>file as its primary argument. - Capability inventory: The script has the capability to write audio files to the filesystem and execute shell commands via the
pocket-ttsandffmpegbinaries. - Boundary markers: The skill instructions explicitly direct the AI agent to manually rewrite source text into a "spoken script" before passing it to the script, providing a layer of human-in-the-loop or agent-mediated sanitization.
- Sanitization: The
tts.shscript includes an embedded Python routine that uses regular expressions to strip markdown formatting (fenced code, links, headers, bullets, and emphasis) and bare URLs from the input text before it reaches the synthesis engine. - [COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary function.
- The
tts.shscript executespipto manage a local virtual environment and install thepocket-ttsdependency. - It invokes the
pocket-ttscommand-line tool to perform the neural speech synthesis. - It utilizes
ffmpegor the macOS-specificafconvertutility to encode and concatenate the final audio output. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to download required components during setup.
- It fetches the
pocket-ttspackage from the Python Package Index (PyPI) if it is not already installed. - The
pocket-ttsengine downloads a neural model (approximately 1GB) from Hugging Face during its first execution. - [DYNAMIC_EXECUTION]: The
tts.shscript uses dynamic execution for internal data processing tasks. - It employs a Python heredoc to execute a script at runtime that handles text cleaning and chunks the input into smaller segments for better synthesis quality.
- It also uses a Python heredoc as a fallback mechanism to join WAV files if
ffmpegis unavailable on macOS.
Audit Metadata