volcengine-doubao-speech-tts
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely informational, providing guidance on API endpoints, protocols, and best practices for the Volcengine Doubao Speech service.
- [CREDENTIALS_UNSAFE]: The documentation correctly demonstrates the use of environment variable placeholders (e.g., ${VOLC_ACCESS_KEY}) rather than hardcoding sensitive credentials.
- [EXTERNAL_DOWNLOADS]: All referenced URLs are official documentation pages from Volcengine (volcengine.com), API endpoints from ByteDance (bytedance.com), or research papers on arXiv (arxiv.org). These are well-known services, and the downloads are documented neutrally as configuration or reference material.
- [INDIRECT_PROMPT_INJECTION]: While the skill involves processing text input for speech synthesis, this is the intended primary purpose of a TTS service. The risk of indirect prompt injection is mitigated by the nature of the sink (audio generation) and the skill's explicit recommendation for text normalization and data privacy. Ingestion points: text inputs for synthesis described in SKILL.md; Boundary markers: absent in raw examples but encapsulated in JSON fields; Capability inventory: network operations to Volcengine APIs; Sanitization: recommends text normalization.
Audit Metadata