tts-skill
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/generate_indextts2_narration.pyexecutesffmpeg,ffprobe,git, anduvusing argument lists. This method is secure against shell injection attacks. - [EXTERNAL_DOWNLOADS]: The helper
assets/minimax_tts.pyperforms POST requests to the MiniMax API (api.minimax.io) to generate audio. This is the intended behavior for the 'Public Article Lane' described in the skill instructions. - [PROMPT_INJECTION]: The skill processes untrusted text data from JSONL segment contracts and a pronunciation lexicon (
references/pronunciation-lexicon.json). While it lacks explicit prompt boundary markers for the TTS engine, it includes avalidate_pronunciationsmechanism to filter forbidden terms. The capabilities associated with this ingestion include file system writes and subprocess execution of media tools.
Audit Metadata