Ai Voice Cloning
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is coherent for generating AI speech through inference.sh, but users should notice that it involves a remote CLI install, login, and sending prompts or media URLs to an external provider.
This skill appears safe to use for its stated purpose if you trust inference.sh. Before installing, verify the CLI installer or checksum, sign in with the intended account, and avoid sending confidential text, images, audio, or video URLs unless you are comfortable with the provider processing them.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the setup command installs software from a remote source before using the skill.
The documented setup pipes a remote install script to a shell. This is disclosed and central to using the inference.sh CLI, but it is still a supply-chain-sensitive install path that users should verify.
curl -fsSL https://cli.inference.sh | sh && infsh login
Review the installer source or use the documented manual checksum verification before installing the CLI.
When invoked, the agent may run inference.sh CLI commands that could create jobs, consume account quota, or process user-supplied content.
The skill allows Bash execution for any `infsh` command, not just the specific text-to-speech examples. This is aligned with the CLI-based purpose, but it is broader than a single scoped app command.
allowed-tools: Bash(infsh *)
Use the skill for intended inference.sh generation tasks and review commands that would spend credits, upload sensitive content, or call non-voice apps.
The CLI may use the user's inference.sh account and associated quota or billing context.
The quick start requires logging into inference.sh, while the registry metadata lists no primary credential. Authenticated use is expected for the service, but the credential/session requirement is under-declared.
infsh login
Log in only with the account you intend to use for generation, and monitor usage or billing on the provider side.
Private scripts, narration, audio URLs, image URLs, or video URLs used with the skill may be processed by external inference services.
The examples send text and other inputs to hosted inference.sh apps. This external provider data flow is disclosed and necessary for the stated purpose, but users should treat submitted prompts and media URLs as shared with the service.
infsh app run infsh/kokoro-tts --input '{ "text": "Hello! This is an AI-generated voice that sounds natural and engaging.", "voice": "af_sarah" }'Do not submit confidential, regulated, or third-party-sensitive material unless the provider's privacy and retention terms are acceptable.