Characteristic Voice

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is coherent for expressive text-to-speech, with the main things to notice being Noiz API key storage and optional upload of text or reference audio to Noiz.

Before installing, decide whether you want the remote Noiz backend or the local Kokoro backend. Do not send sensitive text or private/unauthorized voice recordings to Noiz, protect or remove the saved `~/.noiz_api_key` when appropriate, and manually review any optional download or audio-processing commands before running them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anything you turn into speech with Noiz, including voice samples, may be sent to the Noiz service.

Why it was flagged

The skill clearly discloses that spoken text and optional reference audio leave the machine when the Noiz backend is used.

Skill content
Noiz backend: When using the Noiz backend, the text you speak and any reference audio you provide are sent to `https://noiz.ai/v1`. If you supply `--ref-audio`, that audio file is uploaded for voice cloning.
Recommendation

Use the local Kokoro backend for private content, and only upload reference audio you have permission to use.

What this means

A Noiz API key saved on the machine could be reused by this script, and should be treated like an account credential.

Why it was flagged

The script stores a Noiz API key locally for later use; it applies restrictive file permissions and this behavior is disclosed in SKILL.md.

Skill content
NOIZ_KEY_FILE="$HOME/.noiz_api_key" ... printf '%s' "$normalized" > "$NOIZ_KEY_FILE" ... chmod 600 "$NOIZ_KEY_FILE"
Recommendation

Only configure the API key on a trusted machine, rotate or delete `~/.noiz_api_key` if it is no longer needed, and prefer the local backend if you do not want provider access.

What this means

Installation metadata may not warn you upfront that curl, python3, optional TTS/download tools, or a Noiz API key may be needed.

Why it was flagged

The registry metadata does not declare the runtime tools and optional Noiz credential that SKILL.md and the script document, so users need to rely on the skill instructions for setup details.

Skill content
Required binaries (all must exist): none ... Required env vars: none ... Primary credential: none
Recommendation

Review SKILL.md before use, install optional tools manually only if needed, and verify commands before running reference-audio preparation workflows.