text-to-speech
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the use of a CLI tool named
belt. It properly uses theallowed-toolsfrontmatter to restrict theBashtool to only execute commands starting withbelt, limiting the potential for arbitrary command execution. - [EXTERNAL_DOWNLOADS]: The documentation points to external installation scripts and resources on
inference.shand GitHub to set up the necessary CLI environment. These are standard practices for CLI-based tools and the resources are consistent with the skill's purpose. - [DATA_EXPOSURE]: The skill handles text input for speech synthesis. While this involves sending text to an external inference API (inference.sh), this is the core functionality of the skill and no sensitive local file access was detected.
- [PROMPT_INJECTION]: The skill is designed to process arbitrary text for conversion to speech. While this provides a surface for indirect prompt injection (e.g., embedding instructions in text to be spoken), this is an inherent property of text-to-speech services and is not a malicious feature of the skill itself.
- [SAFE]: No obfuscated code, hidden URLs, persistence mechanisms, or credential harvesting patterns were identified in the instructions or metadata.
Audit Metadata