qwen3-tts-local-inference

• Outcome: Pass
• Latest audit: May 28, 2026 at 1:45 AM UTC
• Version:
  0.0.1

Overview

This skill is a coherent local text-to-speech tool, but users should only use its voice-cloning feature with consent.

Install only if you are comfortable running third-party Python packages and downloading large Hugging Face models. Use voice cloning only with explicit permission from the person whose voice is referenced, and avoid impersonation, fraud, harassment, or misleading audio.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly supports voice cloning from a short reference clip but provides no warning about consent, impersonation risk, or misuse controls. That omission can facilitate non-consensual voice cloning, social engineering, fraud, or harassment by making a high-risk capability appear routine and unrestricted.

VirusTotal

44/44 vendors flagged this skill as clean.