Valtec Vietnamese TTS

• Risk level: Low
• Analyzed: Feb 19, 2026, 10:02 AM
• Findings: 0
• Version: 1.0.3

Overview

The skill's requirements and runtime behavior match its stated purpose (local Vietnamese TTS); nothing embedded in the included files appears malicious, but installing and running the upstream Python repo (pip install -e . and model downloads) is the primary risk and should be handled cautiously.

This skill is internally coherent and appears to do what it claims, but it relies on cloning and pip-installing an external GitHub repository and will download model weights from HuggingFace at runtime. Before installing: (1) Inspect the upstream repository (https://github.com/tronghieuit/valtec-tts) to verify you trust its code; (2) install in an isolated Python virtualenv to avoid contaminating your system Python and to review dependency requirements; (3) avoid setting VALTEC_TTS_DIR to sensitive system paths — use a dedicated tools directory (e.g., ~/.openclaw/tools/valtec-tts); (4) be aware the first run performs network downloads (model weights) and that pip install executes repository packaging logic (which can run arbitrary Python). If you need stricter controls, mirror/verify the repo locally and review infer.py / infer_zeroshot.py before running.