Valtec Vietnamese TTS

• Analyzed: May 12, 2026, 4:21 AM
• Findings: 0
• Version: 1.0.3
• Hash: 81c6f4cce89da821e6448ca340aa464e5a45525fbc4d47ec23c424821819becd
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: valtec-tts Version: 1.0.3 The skill installs an external Python repository (github.com/tronghieuit/valtec-tts) via `git clone` and `pip install -e .` as defined in SKILL.md. The `bin/valtec-tts.js` script acts as a wrapper, executing Python scripts from this installed repository using `node:child_process.spawnSync`. While the Node.js wrapper itself uses a safer method for executing external commands (passing arguments as an array), it passes user-controlled arguments (text, reference file path, output file path) to these external Python scripts. This creates a potential vulnerability vector if the Python scripts themselves do not properly sanitize or handle these inputs, which could lead to arbitrary file operations or code execution within the Python environment, thus classifying it as suspicious due to the inherent risk of executing external code with user-controlled input.