speak-response
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary text from the agent's responses to generate audio output, creating a surface for potential indirect prompt injection attacks.
- Ingestion points: Text is passed as a command-line argument to scripts/speak.sh, scripts/clone.sh, and scripts/design-voice.sh.
- Boundary markers: The scripts do not use delimiters or instructions to prevent processing of instructions that might be embedded in the vocalized text.
- Capability inventory: The skill uses torch for model inference and afplay for local audio playback.
- Sanitization: Shell scripts use double-quoting for input variables, but no further sanitization of the text content is performed.
- [EXTERNAL_DOWNLOADS]: The installation process involves cloning the Qwen3-TTS repository from GitHub and downloading models from Hugging Face. These sources (Alibaba's Qwen project and Hugging Face) are well-known and reputable services for AI assets.
Audit Metadata