voice-cloning-local
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/web_clone_server.pyexecutesffmpegandffprobelocally to verify audio duration and convert formats. These commands are executed using argument lists rather than shell strings, which prevents command injection. - [EXTERNAL_DOWNLOADS]: The skill downloads model weights from the official Qwen organization on Hugging Face. These are legitimate resources from a trusted vendor required for the skill's primary function.
- [DYNAMIC_EXECUTION]: A dynamic import of the
numpylibrary is used inscripts/web_clone_server.pyto handle audio array concatenation. This is a benign use of dynamic loading for a standard library.
Audit Metadata