Her Voice

PassAudited by ClawScan on May 1, 2026.

Overview

Her Voice is a coherent local text-to-speech skill, with disclosed setup downloads and an optional background daemon that users should knowingly enable.

Before installing, be comfortable with the setup script creating ~/.her-voice, installing TTS dependencies, downloading model-related packages, and optionally compiling a macOS visualizer. Use the daemon only if you want a persistent local background process for faster speech.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running setup will download and install third-party code into local virtual environments.

Why it was flagged

The first-run setup installs third-party packages from package repositories, mostly without exact version pinning. This is expected for a local TTS setup, but it is still supply-chain relevant.

Skill content
subprocess.run([pip, "install", "mlx-audio", "numpy"], check=True) ... subprocess.run([pip, "install", "kokoro>=0.8", "soundfile", "numpy"], check=True)
Recommendation

Run setup only if you trust the skill and its dependencies; consider reviewing or pinning dependency versions in a controlled environment.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If started, the daemon may keep using memory and accept local TTS requests until the user stops it.

Why it was flagged

The skill documents an optional background daemon to keep the TTS model loaded. This is disclosed and purpose-aligned, but it continues running until stopped.

Skill content
nohup python3 SKILL_DIR/scripts/daemon.py start > /tmp/her-voice-daemon.log 2>&1 & disown
Recommendation

Start the daemon only if you want faster voice responses, and use the documented stop command when you no longer need it.

What this means

Personal naming and pronunciation preferences may remain on the local machine across sessions.

Why it was flagged

The skill stores user and agent name configuration persistently in ~/.her-voice/config.json. The code uses restrictive file permissions, and this is aligned with pronunciation configuration.

Skill content
"agent_name": "", "user_name": "", "user_name_tts": "" ... CONFIG_FILE = os.path.join(CONFIG_DIR, "config.json")
Recommendation

Only store names or pronunciations you are comfortable keeping locally, and remove ~/.her-voice/config.json if you want to clear them.