tts
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Uses
curlandjqto interact with API endpoints and manage local configuration files for speaker preferences and output settings. - [EXTERNAL_DOWNLOADS]: Fetches audio streams and character data from
api.marswave.ai. As the vendor is the skill author, these are recognized as trusted vendor resources. - [PROMPT_INJECTION]: Ingests untrusted user text for the purpose of speech synthesis. This is the primary function of the skill and the content is not executed as code.
- Ingestion points: User input provided in Step 1 of both Quick and Script modes in
SKILL.md. - Boundary markers: None present.
- Capability inventory: Subprocess execution via
curlandjq, and local filesystem access viamkdirandecho. - Sanitization: None performed on the input text before transmission to the API.
Audit Metadata