speech-synthesis
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
node-edge-ttsandcommanderpackages from the official npm registry during the installation process initiated byinstall.sh. It also makes network requests to Microsoft's established Edge TTS service to generate audio files.\n- [COMMAND_EXECUTION]: The skill executes local Node.js scripts, specificallytts-converter.jsandconfig-manager.js, to process user text and maintain persistent user preferences.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text data via its main CLI argument for speech synthesis. Evidence chain: 1. Ingestion point: Thetextargument intts-converter.js. 2. Boundary markers: The script includes keyword filtering for 'tts' triggers to prevent recursive processing. 3. Capability inventory: The skill performs network operations via thenode-edge-ttslibrary. 4. Sanitization: The script uses thevalidateProsodyValuefunction to ensure pitch, rate, and volume parameters match expected percentage formats.\n- [SAFE]: The skill follows security best practices by storing non-sensitive user preferences in~/.tts-config.jsonand generating temporary audio files in the system's designated temporary directory.
Audit Metadata