local-tts
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
voxcpmpackage from the Python Package Index (PyPI). It also downloads approximately 10GB of model weights from HuggingFace (openbmb/VoxCPM2). HuggingFace is a recognized and well-known service for hosting AI models. - [COMMAND_EXECUTION]: The skill uses shell commands to create a Python virtual environment and execute a bundled synthesis script (
generate.py). These commands utilize theBashtool to runpython3,pip, andfileutilities. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes untrusted text input to generate audio.
- Ingestion points: Text provided via the
--textflag or via stdin. - Boundary markers: None identified in the provided usage examples.
- Capability inventory: The skill has access to shell execution and file reading via its allowed tools.
- Sanitization: The skill does not document specific sanitization or filtering of input text before processing.
Audit Metadata