Voice Reply

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2a21c2f31c071e07e37a0a26dbc48f365583712ca2284c8a6b754903144af154
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for local text-to-speech using sherpa-onnx and Piper voices. The `SKILL.md` and `scripts/install.sh` files contain instructions and commands to download and install necessary binaries and voice models from `https://github.com/k2-fsa/sherpa-onnx/releases/`. While the installation involves `sudo` and `curl` from external sources, these actions are directly aligned with the stated purpose of setting up a local TTS engine and its dependencies. There is no evidence of data exfiltration, malicious execution, persistence, prompt injection attempts against the agent, or other harmful behaviors. The external URLs point to legitimate resources for the project.