Security checks across malware telemetry and agentic risk
This is a legitimate voice skill, but its privacy/offline claims conflict with hosted Edge TTS behavior and it includes unsafe local execution patterns.
Review carefully before installing. Do not treat this as an offline or fully private voice workflow unless the publisher fixes the documentation or replaces hosted Edge TTS with a local TTS engine. Avoid untrusted audio filenames, check what text may be sent to the TTS provider, and prefer pinned dependencies, safer subprocess handling, explicit install prompts, and cache cleanup controls.
if audio_file.endswith('.ogg'):
wav_file = tempfile.mktemp(suffix=".wav")
cmd = f"ffmpeg -i '{audio_file}' -ar 16000 -ac 1 '{wav_file}' -y 2>/dev/null"
subprocess.run(cmd, shell=True, check=True)
audio_file = wav_file
# Transcribe with faster-whisper67/67 vendors flagged this skill as clean.