Kokoro TTS

• Analyzed: May 14, 2026, 3:13 AM
• Findings: 1
• Version: 0.1.0
• Hash: d8a2c52f41261db40bf0d0883854a9cb6a6852b590a383d3ad4fb045fe7374c4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to generate speech using a configurable Kokoro TTS API. It makes a network POST request to the API_URL (defaulting to localhost) with user-provided text, voice, and speed, then saves the resulting audio to a local 'media' directory. There is no evidence of prompt injection in SKILL.md, malicious execution (user input is JSON-encoded, not executed), data exfiltration beyond sending the requested text to the configured TTS endpoint, or persistence mechanisms. All file and network operations are directly aligned with the stated purpose of a text-to-speech skill.