sherpa-onnx-tts

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads its runtime and voice models from the official 'k2-fsa' GitHub repository ('https://github.com/k2-fsa/sherpa-onnx'). These are legitimate project assets required for the skill's primary function of providing offline text-to-speech capabilities.
  • [COMMAND_EXECUTION]: The skill uses spawnSync to execute the downloaded sherpa-onnx-offline-tts binary. Arguments passed to the binary (model paths, output path, and text) are handled as a list of strings, which is a secure way to prevent shell injection. The modification of environment variables like LD_LIBRARY_PATH or PATH is limited to pointing the binary to its own included library files.
  • [SAFE]: The skill implements standard local file operations (checking for binary existence, creating output directories) and adheres to its stated purpose of providing an offline, private TTS solution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 08:31 AM
Security Audit — agent-trust-hub — sherpa-onnx-tts