Dialogue Audio
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the CLI runs code from inference.sh on the user's machine before the skill can be used.
The skill tells the user to execute a remote install script from outside the skill package. This is disclosed and central to the CLI-based workflow, but it is still a supply-chain step users should verify.
curl -fsSL https://cli.inference.sh | sh && infsh login
Only run the installer if you trust the provider; prefer the documented manual install and checksum verification when possible.
If invoked by an agent, the skill has broader CLI authority than a single fixed TTS command.
The skill can invoke any infsh subcommand matching the wildcard, while the documented use case only needs running the Dia TTS app.
allowed-tools: Bash(infsh *)
Review infsh commands before execution and prefer limiting use to the documented falai/dia-tts workflow.
Using the skill may connect actions to the user's inference.sh account.
The workflow requires authentication to the external inference.sh CLI, which is expected for this service but still grants account-level access to the CLI.
infsh login
Log in only with the intended account and understand any provider billing, quota, or account permissions before use.
Dialogue scripts or other prompt text may be processed by an external provider.
The TTS prompt is sent through the external infsh/falai service for generation. This data flow is expected for the skill's purpose, but users should recognize that their dialogue text leaves the local environment.
infsh app run falai/dia-tts --input '{ "prompt": "[S1] Have you tried the new feature yet? ..." }'Avoid including confidential, private, or regulated content in prompts unless the provider's privacy and retention terms are acceptable.