Dialogue Audio

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for creating dialogue audio, but it asks users to install and log in to an external CLI and send prompts to an external TTS provider.

Before installing, verify the inference.sh CLI source and checksum, log in intentionally with the right account, supervise infsh commands, and avoid sending sensitive dialogue text unless you are comfortable with the external provider handling it.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the CLI runs code from inference.sh on the user's machine before the skill can be used.

Why it was flagged

The skill tells the user to execute a remote install script from outside the skill package. This is disclosed and central to the CLI-based workflow, but it is still a supply-chain step users should verify.

Skill content
curl -fsSL https://cli.inference.sh | sh && infsh login
Recommendation

Only run the installer if you trust the provider; prefer the documented manual install and checksum verification when possible.

What this means

If invoked by an agent, the skill has broader CLI authority than a single fixed TTS command.

Why it was flagged

The skill can invoke any infsh subcommand matching the wildcard, while the documented use case only needs running the Dia TTS app.

Skill content
allowed-tools: Bash(infsh *)
Recommendation

Review infsh commands before execution and prefer limiting use to the documented falai/dia-tts workflow.

What this means

Using the skill may connect actions to the user's inference.sh account.

Why it was flagged

The workflow requires authentication to the external inference.sh CLI, which is expected for this service but still grants account-level access to the CLI.

Skill content
infsh login
Recommendation

Log in only with the intended account and understand any provider billing, quota, or account permissions before use.

What this means

Dialogue scripts or other prompt text may be processed by an external provider.

Why it was flagged

The TTS prompt is sent through the external infsh/falai service for generation. This data flow is expected for the skill's purpose, but users should recognize that their dialogue text leaves the local environment.

Skill content
infsh app run falai/dia-tts --input '{ "prompt": "[S1] Have you tried the new feature yet? ..." }'
Recommendation

Avoid including confidential, private, or regulated content in prompts unless the provider's privacy and retention terms are acceptable.