Security audit
Security checks across malware telemetry and agentic risk
This is a real text-to-speech skill, but its prominent offline framing does not fully match its remote HTTP modes and unauthenticated network server behavior.
Install only if you understand that this skill is not strictly offline in all modes. Keep QWEN_TTS_REMOTE unset for private local use, do not send sensitive text to remote servers, bind any server to localhost or a tightly controlled private network, and add authentication/TLS or firewall restrictions before exposing it.
print(f"🎙️ Voice: {voice_desc[:60]}...", file=sys.stderr)
try:
response = requests.post(
f"{remote_url}/tts",
json={
"text": text,print(f"🌐 Using remote server: {remote_url}", file=sys.stderr)
try:
response = requests.post(
f"{remote_url}/tts",
json={
"text": text,66/66 vendors flagged this skill as clean.
No suspicious patterns detected.