Fully offline Qwen3 TTS for your agent

PendingStatic analysis audit pending.

Overview

No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the upstream repository or its dependencies change or are compromised, installing the skill could run different code than the artifacts reviewed here.

Why it was flagged

First-time setup executes a remote installer from GitHub's mutable main branch rather than a pinned, reviewed artifact; this is especially notable because the registry reports no install spec.

Skill content
bash <(curl -fsSL https://raw.githubusercontent.com/daMustermann/claw-qwen3-tts/main/install.sh)
Recommendation

Avoid automatic curl-bash installation. Prefer a pinned commit or packaged ClawHub artifact, inspect the installer before running it, and pin dependencies/model revisions where possible.

What this means

If configured, these tokens let the local server send audio messages through your messaging accounts.

Why it was flagged

The skill supports Telegram bot and WhatsApp Business API credentials, which can authorize sending messages from user-controlled accounts.

Skill content
"telegram": { "bot_token": "", "default_chat_id": "" }, "whatsapp": { "phone_number_id": "", "access_token": "" }
Recommendation

Only configure messaging credentials if needed, use least-privilege tokens where possible, keep config files private, and confirm recipients before sending.

What this means

Audio sent through these integrations leaves the local machine and is shared with the selected messaging provider and recipient.

Why it was flagged

The WhatsApp integration uploads local audio to Meta's Graph API; the Telegram sender similarly posts audio to Telegram's Bot API.

Skill content
upload_url = f"{GRAPH_API_BASE}/{phone_number_id}/media" ... files={"file": (Path(ogg_path).name, f, "audio/ogg; codecs=opus")}
Recommendation

Treat messaging as an online sharing action, not offline TTS. Send only user-approved generated audio and verify the destination account or phone number.

What this means

Cloned voice material may remain available to the agent after the original task unless you delete it.

Why it was flagged

Designed or cloned voice profiles are persistent local data that can be reused in later sessions.

Skill content
Voices are stored locally in `voices/` and persist across sessions. The agent automatically prompts to save after every voice design or clone operation.
Recommendation

Save cloned voices only with consent, use clear names, and delete voice profiles you no longer want retained.

What this means

The TTS server may keep running after the immediate request, consuming resources and exposing its localhost API.

Why it was flagged

The server is intentionally launched as a background process and tracked by a PID file until stopped.

Skill content
nohup python -m uvicorn tts_server:app ... > "$LOGFILE" 2>&1 &
echo $! > "$PIDFILE"
Recommendation

Stop the server when finished using `scripts/stop_server.sh` and review `server.log` if behavior is unexpected.