Tts

Convert text to speech using Hume AI (or OpenAI) API. Use when the user asks for an audio message, a voice reply, or to hear something "of vive voix".

Security Scan

The skill's code and instructions match its TTS purpose, but metadata omits required API keys and the SKILL.md and files disagree about which secrets are needed — that inconsistency should be resolved before trusting the skill.

Purpose & Capability

The skill name, description, and included scripts (Hume and OpenAI TTS) are coherent with a text-to-speech purpose. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and scripts clearly require HUME_API_KEY (and reference HUME_SECRET_KEY) and OPENAI_API_KEY. The missing declaration of those secrets in metadata is an incoherence.

Instruction Scope

SKILL.md instructs running the included Node scripts with the provider API keys and to send the resulting MP3 via the agent 'message' tool. The runtime instructions only send the provided text to the Hume or OpenAI TTS endpoints and write the resulting file; they do not attempt to read unrelated files or system secrets. Minor scope issues: SKILL.md mentions HUME_SECRET_KEY though the Hume script only reads HUME_API_KEY, and the documentation does not state that node/npm dependencies must be installed despite package.json/package-lock being present.

Install Mechanism

There is no install spec (instruction-only), which is lower risk, but the repository includes package.json and a large package-lock.json indicating Node dependencies (openai, commander). The skill will likely require an npm install/npm ci and a Node runtime to run the scripts; this is not declared. No downloads from untrusted URLs or extract steps are present.

Credentials

The scripts require sensitive API keys (OPENAI_API_KEY and HUME_API_KEY) to operate — this is proportionate to TTS functionality. However the skill metadata did not declare these environment requirements or a primary credential. SKILL.md also references HUME_SECRET_KEY which the Hume script does not use. The mismatch between declared/required secrets is a red flag because it obscures what credentials the skill will access.

Persistence & Privilege

The skill does not request persistent or elevated privileges. always is false, it does not modify other skills or system configuration, and it does not request installation hooks or agent-wide changes.

What to consider before installing

What to consider before installing: - The skill will send user-provided text to external TTS services (api.hume.ai or OpenAI). Only use it if you trust those services and are comfortable sending text/audio content to them. - The metadata omits required environment variables. The scripts expect OPENAI_API_KEY and HUME_API_KEY (SKILL.md also mentions HUME_SECRET_KEY, but the Hume script does not use it). Ask the publisher to correct metadata or don't install until clarified. - Running the scripts requires Node and the npm dependencies in package.json/package-lock. Expect to run npm install/npm ci in the skill directory; run this in an isolated environment if you are cautious. - The scripts write an audio file and print an absolute path line prefixed with MEDIA:, which the agent will use to send the file. Be mindful that absolute paths can reveal filesystem layout if shared. - If you proceed, prefer using ephemeral or restricted API keys (least privilege) and test in a sandboxed environment. If the provider or skill source is untrusted, do not provide long-lived credentials.

Text-to-Speech (TTS)

Convert text to speech and generate audio files (MP3).

Hume AI (Preferred)

• Preferred Voice: 9e1f9e4f-691a-4bb0-b87c-e306a4c838ef
• Keys: Stored in environment as HUME_API_KEY and HUME_SECRET_KEY.

Usage

HUME_API_KEY="..." HUME_SECRET_KEY="..." node {baseDir}/scripts/generate_hume_speech.js --text "Hello Jonathan" --output "output.mp3"

OpenAI (Legacy)

• Preferred Voice: nova
• Usage: OPENAI_API_KEY="..." node {baseDir}/scripts/generate_speech.js --text "..." --output "..."

General Notes

• The scripts print a MEDIA: line with the absolute path to the generated file.
• Use the message tool to send the resulting file to the user.