ttscn
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runto executeffmpegandffprobecommands for audio processing. These operations include converting audio parts to a consistent 48kHz mono WAV format, probing audio duration for metadata reporting, and concatenating multiple audio segments into a single output file. The commands use internally generated temporary file paths. - [EXTERNAL_DOWNLOADS]: The skill retrieves synthesized audio content and timing metadata from several cloud TTS providers (e.g., Alibaba Qwen, Atlas Cloud, and MiniMax) via
requests.get. It also supports downloading user-provided reference audio URLs for voice enrollment in theclone.pyscript. These operations are core to the text-to-speech functionality. - [DYNAMIC_EXECUTION]: The backend registry in
scripts/backends/__init__.pyuses the__import__function to load specific backend adapter modules at runtime. This dynamic loading is based on static configurations defined in the localdata/providers.jsonfile and is used to initialize the requested TTS platform. - [INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary text from users or external files to generate speech. While this represents a surface for indirect prompt injection, the risk is negligible as the input is synthesized into audio for human consumption and is not re-interpreted as commands or instructions by the agent framework.
Audit Metadata