tts-generation
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- System Command Execution: The skill uses
subprocess.run()to invokeffmpegfor audio processing. This is a standard practice for applying audio filters like the telephone effect mentioned in the documentation. - Evidence: Found in
scripts/generate_tts.pywithin theapply_telephone_filterfunction, which uses a list-based argument structure (a secure coding practice) to call ffmpeg. - Data Ingestion for Processing: The skill reads a local script file (
script.md) to generate speech. While the data is untrusted, the skill uses structured parsing and passes the text to an official AI SDK for conversion, which is the intended use case. - Evidence: The
main()function reads from{workspace}/data/script.mdand passes content to thesplit_script_by_turnsandgenerate_tts_singlefunctions. - External API Interaction: The skill interacts with the Google GenAI Interactions API to generate speech. This uses official client libraries and targets established service endpoints.
- Evidence: Usage of the
google.genaiclient andgemini-3.1-flash-tts-previewmodel inscripts/generate_tts.py.
Audit Metadata