fish-audio-tts
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a standard interface for text-to-speech generation, which involves processing untrusted text input to produce audio output. \n
- Ingestion points: Text content provided to the
tts.convert,tts.stream, andtts_livemethods as shown in SKILL.md. \n - Boundary markers: The skill does not implement delimiters for user input, as the engine is intended to synthesize the provided string literally including expressive markers. \n
- Capability inventory: The skill facilitates network requests to
api.fish.audioand local file operations to save synthesized audio. \n - Sanitization: The skill provides an optional
normalizeparameter for linguistic text expansion; no specific security filtering is applied to the input text. \n- [SAFE]: The skill relies on official documentation and resources from the vendor and reputable platforms like GitHub and Hugging Face. The use of placeholders for API keys ensures that no sensitive credentials are exposed, and the skill includes appropriate guidance on user consent and legal compliance for voice cloning activities.
Audit Metadata