sherpa-onnx-tts
Pass
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the pre-compiled sherpa-onnx runtime and VITS voice models from the official k2-fsa/sherpa-onnx GitHub repository releases. These are standard external dependencies for local TTS functionality.- [COMMAND_EXECUTION]: The wrapper script uses
spawnSyncwith an array of arguments to execute the downloaded offline TTS binary. This approach prevents shell injection vulnerabilities.- [COMMAND_EXECUTION]: Environment variables for library search paths (LD_LIBRARY_PATH and DYLD_LIBRARY_PATH) are modified at runtime to allow the binary to load its required shared libraries, which is a necessary configuration for this standalone tool.
Audit Metadata