qwencloud-audio-tts

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/gossamer.py to execute a local update-check script if found in sibling directories. The execution is controlled, uses the current Python executable, and targets specific filenames within the skill's infrastructure.
  • [EXTERNAL_DOWNLOADS]: The skill includes functionality to download generated audio files from the official DashScope API endpoints. It also contains instructions for the agent to suggest installing the qwencloud-update-check skill using the platform's standard package manager (npx skills add) if updates are detected.
  • [CREDENTIALS_SAFE]: The skill explicitly instructs against hardcoding API keys and provides clear guidance on using environment variables or .env files. qwencloud_lib.py includes a mask_key function to prevent sensitive data from being logged in error messages.
  • [DATA_HANDLING]: qwencloud_lib.py provides robust file handling, including local file resolution and optional upload to Alibaba Cloud OSS for multi-modal processing. These operations are transparent and consistent with the skill's primary purpose of audio generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 01:25 PM