sherpa-onnx-tts
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads its runtime and voice models from the official 'k2-fsa' GitHub repository ('https://github.com/k2-fsa/sherpa-onnx'). These are legitimate project assets required for the skill's primary function of providing offline text-to-speech capabilities.
- [COMMAND_EXECUTION]: The skill uses
spawnSyncto execute the downloadedsherpa-onnx-offline-ttsbinary. Arguments passed to the binary (model paths, output path, and text) are handled as a list of strings, which is a secure way to prevent shell injection. The modification of environment variables likeLD_LIBRARY_PATHorPATHis limited to pointing the binary to its own included library files. - [SAFE]: The skill implements standard local file operations (checking for binary existence, creating output directories) and adheres to its stated purpose of providing an offline, private TTS solution.
Audit Metadata