The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): The skill instructions in references/finetuning.md require cloning a repository from an untrusted source (github.com/QwenLM/Qwen3-TTS) and executing local Python scripts (prepare_data.py, sft_12hz.py) within that repository.
[COMMAND_EXECUTION] (HIGH): The skill documentation in SKILL.md provides commands to launch a Gradio web service using qwen-tts-demo with the --ip 0.0.0.0 flag. This binds the service to all network interfaces, potentially exposing the host system and the agent's capabilities to unauthorized network access.
[EXTERNAL_DOWNLOADS] (MEDIUM): The environment setup requires installing packages (qwen-tts, flash-attn) from external registries. While standard, these are not from the specified trusted organizations.
[DYNAMIC_EXECUTION] (MEDIUM): The command pip install -U flash-attn --no-build-isolation triggers runtime compilation of C++/CUDA code, which is a form of dynamic execution of untrusted build instructions.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill ingests untrusted text data via text and instruct parameters in generate_custom_voice and generate_voice_design methods.
Ingestion points: text, instruct, and ref_text parameters in SKILL.md and references/api_reference.md.
Boundary markers: Absent; instructions are directly interpolated into model inputs.
Capability inventory: Subprocess calls for Gradio demo (qwen-tts-demo) and fine-tuning scripts; file-write via sf.write.
Sanitization: No evidence of input sanitization or filtering for the instructions provided to the TTS models.

qwen3-tts