change-voice

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes ffmpeg, ffprobe, and curl via the subprocess.run function to perform audio analysis and retrieve catalog assets. These calls are implemented securely using command lists without shell invocation, and the curl operations specifically include the -- boundary marker to prevent argument injection attacks from external data.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves voice preview MP3 files from the author's official API endpoint (api.novoads.ai). These downloads are strictly enforced over HTTPS and are used locally for pitch measurement and auditioning purposes. The resulting files are stored in a temporary directory using sanitized filenames generated from a hash of the source URL.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 11:13 PM