TTS WhatsApp

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill’s documented behavior matches its purpose, but it can send WhatsApp messages through your account and relies on external tools you should verify.

This appears coherent for generating and sending WhatsApp voice messages. Before installing, verify the external dependencies and any cloned code, test with --no-send, set the default target carefully, and confirm recipients before sending to individuals or groups.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken message, target number, or group ID could send an unintended voice message from your WhatsApp account.

Why it was flagged

Sending WhatsApp voice messages, including to groups, is the core feature and is disclosed, but it is an external action with social/account impact.

Skill content
- 📤 **Automatic sending** via Clawdbot; - 👥 **Group support** - Send to individuals or WhatsApp groups
Recommendation

Use --no-send for testing, confirm the recipient or group ID, and review the text before allowing automatic delivery.

What this means

The workflow can act through your WhatsApp identity and may expose recent WhatsApp message metadata/content during setup.

Why it was flagged

The skill relies on a WhatsApp-connected Clawdbot account and documents reading WhatsApp channel messages to discover group IDs.

Skill content
✅ **WhatsApp** connected to Clawdbot ... clawdbot message read --channel whatsapp
Recommendation

Install only where you trust the local Clawdbot WhatsApp setup, and avoid granting access to accounts or groups you do not want the agent to use.

What this means

You may run or download code/models that were not included in this submitted skill package.

Why it was flagged

The setup uses external, unpinned package/model downloads and a manual clone path. These steps are user-directed and purpose-aligned, but users should verify sources.

Skill content
pip3 install --user piper-tts ... git clone https://github.com/clawdbot/clawdhub.git temp ... wget https://huggingface.co/rhasspy/piper-voices/resolve/main/...
Recommendation

Install dependencies from trusted sources, prefer pinned versions or checksums when available, and inspect any cloned implementation before running it.

What this means

Sensitive message content could remain on disk longer than expected if sending fails.

Why it was flagged

Generated audio files can contain the user’s message content and may remain locally after failed sends or until a later cleanup run.

Skill content
- **Auto-delete after send** ... - **Auto-cleanup old files** ... - **Keep on error** - Files preserved if sending fails
Recommendation

Avoid sending highly sensitive text unless you are comfortable with temporary local files, and manually clean generated files after failures if needed.