ClawHub

say

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only macOS text-to-speech skill whose persistent language-setting examples are visible and purpose-aligned, though users should understand they can affect later speech output.

Install is reasonable if you want macOS text-to-speech examples. Before using the Siri Natural Voice language examples, note your current speech language or be prepared to switch it back, because `defaults write` changes a persistent macOS speech preference rather than only one command invocation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation instructs users to run `defaults write` against `com.apple.speech.voice.prefs SystemTTSLanguage`, which changes a persistent macOS preference rather than a one-shot runtime option. This can silently alter later system/app TTS behavior beyond the immediate task, and the skill does not prominently warn that the setting persists or advise restoring the prior value.

Session Persistence

Medium
Category
Rogue Agent
Content
## Siri Natural Voices (recommended)

Siri voices are the best macOS TTS voices but **cannot be selected via `-v`**. Instead, run `say` without `-v` — it uses the system default voice. Switch languages via `defaults write`:

```bash
# Switch to German
Confidence
91% confidence
Finding
defaults write

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# Switch to German
defaults write com.apple.speech.voice.prefs SystemTTSLanguage -string "de"
say "Hallo, wie geht's?" -o output_de.aiff

# Switch to Chinese (Mandarin)
Confidence
95% confidence
Finding
defaults write

Session Persistence

Medium
Category
Rogue Agent
Content
say "Hallo, wie geht's?" -o output_de.aiff

# Switch to Chinese (Mandarin)
defaults write com.apple.speech.voice.prefs SystemTTSLanguage -string "cmn"
say "你好，世界" -o output_zh.aiff
```
Confidence
95% confidence
Finding
defaults write

Session Persistence

Medium
Category
Rogue Agent
Content
- `say` adds natural pauses at punctuation — no manual sentence splitting needed
- AIFF is the native output format; convert with ffmpeg for WAV/MP3
- For batch generation: set language once, generate all clips, then switch — minimizes `defaults write` calls
Confidence
88% confidence
Finding
defaults write

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal