kokoro-tts
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates as described, providing a bridge to a text-to-speech service. All technical operations, such as network requests and file management, are transparent and aligned with its intended purpose.- [EXTERNAL_DOWNLOADS]: The script
scripts/tts.jsperforms a network POST request to the Kokoro API to generate speech. By default, this targetshttp://localhost:8880, but the destination is configurable via theKOKORO_API_URLenvironment variable. This is a legitimate functional requirement.- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script (scripts/tts.js). The script safely handles command-line arguments and uses them to construct a JSON payload for the TTS API, with no evidence of shell injection vulnerabilities or unauthorized command execution.
Audit Metadata