doubao-tts
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches audio files and timing metadata from Volcengine (ByteDance) API endpoints (
openspeech.bytedance.com). This is the intended function of the skill and uses a well-known service provider. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate speech, which is then sent to an external API and saved locally.
- Ingestion points: The
textparameter passed to theDoubaoTTSorTTSSelectorexecution calls inSKILL.md. - Boundary markers: None explicitly defined in the tool invocation instructions.
- Capability inventory: Performs network requests to ByteDance APIs and writes generated audio files and JSON metadata to local paths specified by the user.
- Sanitization: The documentation does not specify sanitization or validation of the input text before processing.
Audit Metadata