doubao-tts
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the official API endpoints for Bytedance's OpenSpeech service (openspeech.bytedance.com) to generate audio content and retrieve timing metadata.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-supplied text for synthesis into speech.
- Ingestion points: The
textparameter in theexecutemethod for both theTTSSelectorandDoubaoTTStools (SKILL.md). - Boundary markers: No specific boundary markers or instructions to ignore embedded commands within the synthesis text are provided.
- Capability inventory: The skill performs network operations to external API endpoints and writes binary audio and JSON metadata files to the local file system (SKILL.md).
- Sanitization: No explicit sanitization or filtering of the input text is mentioned, though the risk is localized to the synthesis output rather than agent control flow.
- [SAFE]: The documentation includes explicit safety instructions to prevent the exposure of the
DOUBAO_SPEECH_API_KEY, mandating the use of.envfiles and prohibiting the logging or archival of credentials.
Audit Metadata