speech-synthesis

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the node-edge-tts and commander packages from the official npm registry during the installation process initiated by install.sh. It also makes network requests to Microsoft's established Edge TTS service to generate audio files.\n- [COMMAND_EXECUTION]: The skill executes local Node.js scripts, specifically tts-converter.js and config-manager.js, to process user text and maintain persistent user preferences.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text data via its main CLI argument for speech synthesis. Evidence chain: 1. Ingestion point: The text argument in tts-converter.js. 2. Boundary markers: The script includes keyword filtering for 'tts' triggers to prevent recursive processing. 3. Capability inventory: The skill performs network operations via the node-edge-tts library. 4. Sanitization: The script uses the validateProsodyValue function to ensure pitch, rate, and volume parameters match expected percentage formats.\n- [SAFE]: The skill follows security best practices by storing non-sensitive user preferences in ~/.tts-config.json and generating temporary audio files in the system's designated temporary directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 04:38 PM