Ai Voice Cloning

• Outcome: Pass
• Latest audit: May 28, 2026, 7:38 AM
• Version:
  0.1.5

Overview

This skill is a coherent AI voice-generation helper, but users should understand that voice/text/media inputs go to inference.sh and the CLI install uses a remote shell script.

Install only if you trust inference.sh and are comfortable reviewing or manually installing its CLI. Do not submit private scripts, regulated data, unconsented voice samples, portraits, or videos unless you have permission and accept the provider’s data handling terms.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill repeatedly instructs users to submit text and remote audio/image/video URLs to external inference services without a clear, prominent disclosure of data egress and third-party processing. This creates privacy and compliance risk because users may unknowingly transmit sensitive script content, voice samples, portraits, or media URLs to an external platform.

VirusTotal

66/66 vendors flagged this skill as clean.