tts
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads a Telegram bot token and chat IDs from the local configuration file
~/.cli-jaw/settings.json. It subsequently uses these credentials to send audio files to the Telegram Bot API (api.telegram.org). While this matches the skill's documented purpose for voice delivery, it involves accessing local credentials and transmitting data to an external service. - [EXTERNAL_DOWNLOADS]: The skill instructs the user to install
edge-ttsviapipandffmpegviabrew. These are legitimate, well-known software packages used for speech synthesis and audio format conversion. - [COMMAND_EXECUTION]: The skill executes multiple command-line utilities, including
ffmpeg,edge-tts, and the macOSsaycommand. It also involves the generation and execution of temporary Python scripts within the/tmp/directory to handle logic for speech generation and Telegram API communication.
Audit Metadata