The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches AI model weights from Hugging Face and installs necessary Python modules from GitHub. All external references are pinned to specific versions to prevent supply chain attacks.
Evidence: scripts/setup.py and scripts/providers.py pin Hugging Face repositories (e.g., OpenMOSS-Team/MOSS-TTS-Nano-100M-ONNX, Qwen/Qwen3-TTS) to specific revisions and install moss-tts-nano from GitHub using a fixed commit hash (8b7bcc9).
[COMMAND_EXECUTION]: Subprocess calls are used to interface with legitimate system utilities for audio processing and environment configuration.
Evidence: scripts/build.py and scripts/common.py utilize ffmpeg for audio assembly and normalization; scripts/clone-minimax.py uses ffprobe for audio duration checks; scripts/setup.py uses uv for virtual environment management; scripts/providers.py invokes the mmx CLI for cloud synthesis tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes external text files (script.md) and audio recordings. It maintains security by avoiding shell interpolation and using structured arguments for all subprocess calls.
Ingestion points: User-provided scripts and reference audio recordings entered via command-line arguments.
Boundary markers: Text is segmented into discrete chapters and sentences before being passed to synthesis engines.
Capability inventory: The skill is restricted to file operations within its output directory and network requests to established TTS providers (MiniMax, Hugging Face).
Sanitization: Employs subprocess.run with list-based arguments to prevent command injection from user-provided text strings.

voice-clone-tts