kokoro-tts

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill operates as described, providing a bridge to a text-to-speech service. All technical operations, such as network requests and file management, are transparent and aligned with its intended purpose.- [EXTERNAL_DOWNLOADS]: The script scripts/tts.js performs a network POST request to the Kokoro API to generate speech. By default, this targets http://localhost:8880, but the destination is configurable via the KOKORO_API_URL environment variable. This is a legitimate functional requirement.- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script (scripts/tts.js). The script safely handles command-line arguments and uses them to construct a JSON payload for the TTS API, with no evidence of shell injection vulnerabilities or unauthorized command execution.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 10:49 AM
Security Audit — agent-trust-hub — kokoro-tts