Skillv1.0.0

ClawScan security

Chattts · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

ReviewMar 16, 2026, 2:00 PM

Verdict: Review
Confidence: medium
Model: gpt-5-mini
Summary: The skill's code and instructions implement a local TTS client (consistent with its description), but registry metadata and small mismatches (a hardcoded private IP, a literal URL listed as a required env var/primary credential, and a port mismatch in the error text) are incoherent and warrant caution before installing.
Guidance: This skill appears to be a simple Node client for a ChatTTS server and mostly behaves as described, but there are configuration inconsistencies you should resolve before installing: - Metadata issue: the registry lists a literal URL (http://172.23.252.114:8020) as a required env var and as the primary credential. That is likely a mistake; the script expects an environment variable named CHATTTS_API_URL. Ask the publisher to fix the metadata. - Default endpoint: the script defaults to a private IP (172.23.252.114:8020). Verify that this host is one you control/trust. If not, set CHATTTS_API_URL to a trusted localhost or internal server before use. - Port mismatch: the script's default port is 8020, but the error message mentions checking port 8080 — another sign of sloppy editing. Confirm which port your ChatTTS server actually uses. - Privacy: any text you pass to the skill is POSTed to the configured API. Don’t send sensitive content unless you trust the API host. Recommended actions: inspect or run the included scripts in an isolated environment; correct CHATTTS_API_URL in the skill metadata or set CHATTTS_API_URL explicitly to a known endpoint (e.g., http://127.0.0.1:8020) if you run a local server; request source/homepage or author verification if you need higher assurance. If the author fixes the metadata and confirms the endpoint is local/controlled, this would likely be coherent/benign.

Review Dimensions

Purpose & Capability: noteThe skill is a Node-based client that POSTs text to a ChatTTS FastAPI server and returns a local .wav path — this matches the stated TTS purpose and the requirement for the 'node' binary. However, the registry's 'required env vars' field contains a literal URL (http://172.23.252.114:8020) instead of an environment variable name (SKILL.md and the script expect CHATTTS_API_URL). That metadata mismatch is unexpected and likely a misconfiguration.
Instruction Scope: okSKILL.md and scripts/tts.mjs limit actions to reading CHATTTS_API_URL (or using the built-in default), sending the provided text to /v1/audio/speech, and printing the generated file path. The script does not read arbitrary files or other env vars. Note: the script will send any provided text to the configured API endpoint — so the privacy/security of the input depends on where that endpoint points.
Install Mechanism: okThis is an instruction-only skill with a small included Node script and no install spec; nothing is downloaded or written by an installer. Risk from install mechanism is low.
Credentials: concernThe declared required env var in registry metadata is a URL literal (http://172.23.252.114:8020) and primaryEnv is the same URL; this is malformed and disproportionate — expected: a single env var name (CHATTTS_API_URL). The script defaults to a private IP (172.23.252.114:8020), so by default user text will be sent to that host. While no secret keys are requested, sending arbitrary text to an unknown IP can expose sensitive content.
Persistence & Privilege: okThe skill is not marked always:true and doesn't request elevated persistence. It does not modify other skills or system-wide configs in the provided files.