espeak-ng
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: espeak-ng Version: 1.0.2 The skill bundle is designed for text-to-speech using `espeak-ng`. The `espeak_skill.py` script securely executes the `espeak-ng` command via `subprocess.Popen` with a list of arguments, preventing shell injection. Crucially, it sanitizes user input (`sys.argv[1]`) by removing all non-alphanumeric and non-whitespace characters using `re.sub`, effectively mitigating command injection risks. The `SKILL.md` provides clear, benign instructions for the agent and does not contain any prompt injection attempts or instructions for unauthorized actions. All components align with the stated purpose without exhibiting malicious intent or significant vulnerabilities.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing and using the skill will cause the agent to run the local espeak-ng program to speak provided text.
The skill runs a local executable. This is expected for text-to-speech generation and uses an argument list rather than shell execution, but users should know it invokes a system binary.
command = ["espeak-ng", text, "-v", voice, "-a", str(rate), "-p", str(pitch)] ... subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
Install espeak-ng only from trusted package sources and keep use limited to text you intend to synthesize.
A user may need to install an external TTS package before the skill works.
The skill depends on external software installation. The dependency is clearly documented and purpose-aligned, but users should verify the package source because the registry metadata does not declare a required binary or install spec.
- espeak-ng must be installed on the system ... Ubuntu/Debian: `sudo apt-get install espeak-ng` ... macOS: `brew install espeak-ng` ... windows 11 : espeak-ng.msi from https://github.com/espeak-ng/espeak-ng/releases
Use official OS package repositories or verified upstream releases, and avoid installing binaries from untrusted mirrors.