Kokoro TTS
v0.1.0Generate spoken audio from text using the local Kokoro TTS engine. Use when the user asks to "say" something, requests a voice message, or wants text converted to speech.
⭐ 1· 5.9k·33 current·33 all-time
by@edkief
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name, description, and included script all align with a TTS purpose. However, SKILL.md and the script rely on a KOKORO_API_URL environment variable but the registry metadata lists no required env vars — an inconsistency in declared requirements.
Instruction Scope
Runtime instructions are narrowly scoped to generating speech: set KOKORO_API_URL, run the provided Node.js script, and the script writes an MP3 into ./media and prints a MEDIA: path. The instructions do not request unrelated system files or credentials.
Install Mechanism
No install spec; this is an instruction-only skill with a small included Node.js script. No remote downloads or archive extraction are performed by the skill itself.
Credentials
Although no required env vars are declared in the metadata, the script and SKILL.md use KOKORO_API_URL (defaults to http://localhost:8880/v1/audio/speech). Because the endpoint is configurable, user text will be POSTed to whatever URL is set — if that URL points to an untrusted remote server, sensitive content could be exfiltrated. The metadata should explicitly declare KOKORO_API_URL.
Persistence & Privilege
The skill does not request always:true and will not modify other skills or system-wide configs. It writes media files into the current working directory (media/), which is expected behavior for a TTS tool.
What to consider before installing
This skill appears to do only text→speech via a Kokoro API, but there are two things to check before installing: (1) provenance — the skill's source/homepage is unknown; (2) endpoint configuration — by default it posts to localhost, but if KOKORO_API_URL is set to a remote URL that server will receive the raw text you send. Only set KOKORO_API_URL to a server you trust. Also note the skill writes MP3s to a local media/ folder. Recommend: review the included scripts/tts.js yourself (or run in a sandbox), add KOKORO_API_URL to the skill metadata if you accept it, and avoid sending sensitive content unless you control or trust the configured TTS server.Like a lobster shell, security has layers — review code before you run it.
latestvk9705cx1tjy7k1f6jhwyydmfsn80b5av
License
MIT-0
Free to use, modify, and redistribute. No attribution required.