tts
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to manage its lifecycle. It uses
mkdirandechoto initialize configuration in.listenhub/tts/config.json, and employscatandjqto read and manipulate JSON settings. It interacts with thelistenhubbinary to generate audio content, specifically callinglistenhub tts createandlistenhub creation getfor status polling. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto download generated audio files (.mp3) from URLs provided by thelistenhubservice. These downloads are performed to the local working directory after user confirmation. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and scripts for conversion to speech.
- Ingestion points: Text is ingested via user prompts in
SKILL.md(Step 1 in both Quick and Script modes). - Boundary markers: The skill uses a
<HARD-GATE>requiring explicit user confirmation of the text and voice selection before any generation command is executed. - Capability inventory: The skill can execute shell commands via the
listenhubCLI and download files viacurl. - Sanitization: The skill uses
jqto safely wrap user input into JSON objects for the CLI, reducing the risk of command injection via the text content.
Audit Metadata