local-tts
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs local audio generation using legitimate libraries (mlx-audio, pydub) and downloads models from Hugging Face, which is a trusted platform for machine learning assets.
- [EXTERNAL_DOWNLOADS]: The documentation includes instructions for installing the uv package manager via a remote script from astral.sh, which is the official and well-known installation method for the utility.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text input to generate speech, creating an attack surface for indirect prompt injection.
- Ingestion points: The script generate_audio.py reads text from command-line arguments or local files.
- Boundary markers: No explicit delimiters or instructions are used to separate user data from the processing logic.
- Capability inventory: The skill's capabilities are limited to local file system reads and audio file writes (MP3/WAV).
- Sanitization: No validation or sanitization of the input text is performed before it is passed to the local TTS model.
Audit Metadata