Skills
skills/inference-sh-3/skills/text-to-speech/Gen Agent Trust Hub

text-to-speech

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the user to download and execute an installation script from https://cli.inference.sh. This domain is controlled by the skill's author (inference-sh-3) and serves as the official source for the platform's CLI.\n- [COMMAND_EXECUTION]: Utilizes the infsh CLI tool to run audio processing applications and uses npx to manage related platform skills.\n- [EXTERNAL_DOWNLOADS]: Fetches binary distributions and security checksums from dist.inference.sh to facilitate the installation and update process.\n- [PROMPT_INJECTION]: The skill contains an indirect injection surface. 1. Ingestion point: The --input parameter used in infsh app run commands. 2. Boundary markers: No specific delimiters or safety warnings are present in the command templates. 3. Capability inventory: The skill has shell execution capabilities via the infsh tool. 4. Sanitization: No explicit validation or escaping is defined in the instructions for the text inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 01:02 AM