Multi-role TTS Skill
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's files, dependencies, and runtime instructions are consistent with a multi-role TTS audio generator; it does require system installs and uses sudo during installation but does not request unrelated credentials or perform obvious exfiltration.
This package appears to be what it claims: a multirole TTS generator that calls edge-tts and ffmpeg. Before installing, review the repository locally and consider these points: - The installer runs with sudo and will copy the entire repo into a system OpenClaw skills directory and create a /usr/local/bin symlink; run it only on systems where you trust the source. - edge-tts will make network requests to Microsoft endpoints to synthesize speech; no credentials are requested by the skill, but network access is required. - The install script bootstraps Homebrew via a standard curl | bash URL (common practice) — if you prefer, install dependencies manually (brew/apt/pip) and then run only the parts of install.sh you trust. - package.json lists edge-tts as a dependency even though edge-tts is installed via pip (minor inconsistency) — nothing malicious but indicates the packaging is informal. - If you need extra caution, run the install inside an isolated VM or container, or inspect/modify install.sh to avoid automatic sudo operations. If you plan to use it in production, review config/config.sh (if present) and verify any default mappings before running.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.