skills/agents365-ai/365-skills/ttscn/Gen Agent Trust Hub

ttscn

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute ffmpeg and ffprobe commands for audio processing. These operations include converting audio parts to a consistent 48kHz mono WAV format, probing audio duration for metadata reporting, and concatenating multiple audio segments into a single output file. The commands use internally generated temporary file paths.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves synthesized audio content and timing metadata from several cloud TTS providers (e.g., Alibaba Qwen, Atlas Cloud, and MiniMax) via requests.get. It also supports downloading user-provided reference audio URLs for voice enrollment in the clone.py script. These operations are core to the text-to-speech functionality.
  • [DYNAMIC_EXECUTION]: The backend registry in scripts/backends/__init__.py uses the __import__ function to load specific backend adapter modules at runtime. This dynamic loading is based on static configurations defined in the local data/providers.json file and is used to initialize the requested TTS platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary text from users or external files to generate speech. While this represents a surface for indirect prompt injection, the risk is negligible as the input is synthesized into audio for human consumption and is not re-interpreted as commands or instructions by the agent framework.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 04:42 PM