Back to skill
Skillv0.1.0
ClawScan security
Pocket TTS Complete Documentation · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 11, 2026, 6:07 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only documentation skill for Kyutai Pocket TTS; its declared requirements and runtime instructions are coherent with the stated purpose and it does not request unrelated credentials or installs.
- Guidance
- This skill is documentation for Pocket TTS and appears internally consistent. Before installing or following the instructions consider: (1) installing via 'pip install pocket-tts' runs third-party code — review the package repository and maintainers if you need a higher assurance level; (2) model weights and voice files may be downloaded from HuggingFace or other URLs (public downloads are normal; private models would require tokens you must manage securely); (3) voice-cloning uses your audio files — avoid feeding sensitive or private audio you don't want embedded; (4) the 'serve' command starts a local HTTP server — do not bind it to 0.0.0.0 or an exposed interface unless you understand and secure the service; and (5) if you need higher assurance, review the upstream GitHub repo (https://github.com/kyutai-labs/pocket-tts) and the pip package source before installing. Overall, the skill is coherent and does not request unrelated privileges or secrets.
Review Dimensions
- Purpose & Capability
- okThe name/description (Pocket TTS, CPU-friendly streaming TTS with voice cloning) match the files and instructions. The docs explain CLI, Python API, exporting voices, and serving a local API — all expected for a TTS documentation skill.
- Instruction Scope
- noteSKILL.md is documentation-only and stays within TTS domain. It instructs the user/agent to run pocket-tts CLI commands, install the package via pip/uv, load models, read local audio files or URLs, and optionally start a FastAPI server. These actions are consistent with the stated functionality but do involve reading user audio files and downloading model weights from external URLs (e.g., HuggingFace) if the agent/user follows the docs.
- Install Mechanism
- noteThere is no automated install spec embedded in the skill (instruction-only), which is low-risk. The docs recommend 'pip install pocket-tts' or 'uv add pocket-tts' — installing a third-party package is an expected step but carries the usual risks of executing code from PyPI/uv; the skill itself does not supply or automatically fetch binaries from untrusted URLs.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The documented behavior (loading local files, using HF URLs, writing safetensors/WAV outputs) matches that; there are no unrelated secrets requested.
- Persistence & Privilege
- okThe skill is not forced-always and doesn't request persistent elevated privileges. It documents a 'serve' command that can start a local web server (default host localhost), which is normal for this tool; the skill does not attempt to modify other skills or system-wide configs.