sherpa-onnx-tts
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
sherpa-onnxruntime and a voice model fromgithub.com/k2-fsa/sherpa-onnx. This is a well-known repository for this technology and is used to provide the primary functionality of the skill. - [COMMAND_EXECUTION]: The skill uses
spawnSyncinbin/sherpa-onnx-ttsto execute the downloadedsherpa-onnx-offline-ttsbinary. The command arguments are constructed using parameters for model paths and user-provided text. The execution is localized to the downloaded binary within the skill's managed tool directory. - [DYNAMIC_EXECUTION]: The script modifies environment variables like
LD_LIBRARY_PATHandDYLD_LIBRARY_PATHat runtime to include the locallibdirectory of the downloaded runtime. This is a standard requirement for loading shared libraries associated with the provided binary and is not used for arbitrary library injection.
Audit Metadata