skills/pluviobyte/rnskill/tts-skill/Gen Agent Trust Hub

tts-skill

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/generate_indextts2_narration.py executes ffmpeg, ffprobe, git, and uv using argument lists. This method is secure against shell injection attacks.
  • [EXTERNAL_DOWNLOADS]: The helper assets/minimax_tts.py performs POST requests to the MiniMax API (api.minimax.io) to generate audio. This is the intended behavior for the 'Public Article Lane' described in the skill instructions.
  • [PROMPT_INJECTION]: The skill processes untrusted text data from JSONL segment contracts and a pronunciation lexicon (references/pronunciation-lexicon.json). While it lacks explicit prompt boundary markers for the TTS engine, it includes a validate_pronunciations mechanism to filter forbidden terms. The capabilities associated with this ingestion include file system writes and subprocess execution of media tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 08:47 AM
Security Audit — agent-trust-hub — tts-skill