ClawHub
Back to plugin

Security audit

Sherpa ONNX TTS

Security checks across malware telemetry and agentic risk

Overview

This official OpenClaw plugin coherently provides offline local text-to-speech and does not show hidden data access or unsafe automatic behavior.

Reasonable to install if you want offline TTS. Review that it downloads third-party sherpa-onnx runtime/model assets on macOS, or uses manually supplied assets on Linux/Windows, and that the local native binary receives your process environment when it runs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
usage(`TTS binary not found: ${bin}`);
}

const env = { ...process.env };
const libDir = path.join(runtimeDir, "lib");
if (process.platform === "darwin") {
  env.DYLD_LIBRARY_PATH = prependEnvPath(env.DYLD_LIBRARY_PATH || "", libDir);
Confidence
60% confidence
Finding
.env

VirusTotal

60/60 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.