speak

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local scripts and external binaries to perform its tasks.
  • The PowerShell script speak.ps1 uses the call operator (&) to invoke python for streaming and the edge-tts CLI for file generation.
  • The Python script speak_stream.py uses subprocess.Popen to launch media players (mpv or ffplay) for audio playback.
  • The skill instructions encourage the use of background execution (run_in_background: true), which allows these processes to run detached from the main agent interaction.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as a processing layer for text data which may originate from untrusted external sources (e.g., website summaries or document analysis).
  • Ingestion points: Text is passed to speak.ps1 via the <講稿文字> positional argument or the -File parameter.
  • Boundary markers: There are no explicit delimiters or instructions within the scripts to ignore embedded commands in the text being converted to speech.
  • Capability inventory: The skill can execute PowerShell, Python, and interact with the filesystem (reading files, writing temporary MP3s).
  • Sanitization: The scripts do not perform specific sanitization or escaping of the input text before passing it to the TTS engines or command-line arguments.
  • [EXTERNAL_DOWNLOADS]: The skill relies on the edge-tts Python package and external binaries (mpv, ffplay) being present in the environment. While it does not download these automatically, it requires them to function, and edge-tts communicates with Microsoft's remote servers to generate audio content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 10:57 AM