Voice Reply
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's instructions mostly match a Whisper transcription + Edge TTS workflow, but there are inconsistencies and privacy/operational gaps (claims of "offline"/"no API key", unmentioned network calls, hardcoded user paths, and reliance on PyPI/brew installs) that warrant caution before installing.
Before installing or using this skill, consider: (1) Whisper downloads model files locally (up to ~1.5GB for larger models) — check disk space and initial network bandwidth. (2) edge-tts is an online TTS client that sends text to Microsoft/Edge TTS endpoints (so generated text/audio is transmitted off-device); if you need truly offline TTS, edge-tts is not appropriate. (3) pip and brew installations pull code from PyPI/Homebrew — review package provenance and preferably install into a virtual environment. (4) The sample Python code launches the edge-tts binary with subprocess.run; ensure the binary is from a trusted install and be aware it will execute. (5) The README contains a hardcoded macOS user path and assumes Homebrew; verify/adjust paths for your OS. (6) If privacy is a concern, test with non-sensitive content and/or review network traffic to confirm where data is sent. These issues look like sloppy documentation rather than malicious intent, but you should verify network/privacy behavior and adjust installs accordingly.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.