Pocket Tts

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for local text-to-speech, with disclosed external package/model downloads and an optional local server that users should understand before use.

This appears reasonable for an offline TTS skill if you trust the Pocket TTS/Kyutai package and Hugging Face model sources. Expect initial network downloads, be cautious with custom voice samples, choose output paths deliberately, and only start the local server when you intend to use it.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or running the skill may fetch code and model files from upstream package/model sources, so upstream changes could affect behavior.

Why it was flagged

The skill depends on external package installation and a downloaded model. This is disclosed and purpose-aligned, but the artifacts do not pin versions or provide a registry install spec.

Skill content

pip install pocket-tts ... uvx pocket-tts generate "Hello world" ... First run downloads model (~100M parameters)

Recommendation

Install only from trusted package sources, consider pinning versions where possible, and review/accept the Hugging Face model license intentionally.

Low

#ASI05: Unexpected Code Execution

What this means

Using --serve may leave a local HTTP service running until stopped.

Why it was flagged

The CLI can launch a separate Pocket TTS server command. The command is fixed and user-selected via --serve, so it appears purpose-aligned, but it starts a long-running local service.

Skill content

if args.serve:
        print("🚀 Starting Pocket TTS server on http://localhost:8000")
        os.system("pocket-tts serve")

Recommendation

Use server mode only when needed, stop it afterward, and confirm it binds only to the intended local interface.