Discord Local STT/TTS Installer (macOS)

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill behaves like a disclosed macOS installer, but it fetches and may build the latest upstream plugin code, so users should trust the GitHub project before running it.

This appears to be a coherent installer, not a deceptive skill. Before running it, make sure you trust the vilmire/discord-local-stt-tts GitHub project and are comfortable installing the latest release into your OpenClaw plugins directory and optionally running pnpm dependency/build scripts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

You install whatever code is the latest upstream release at the time you run the script.

Why it was flagged

The installer dynamically downloads the latest GitHub release source zipball from a fixed upstream repo rather than a pinned version or checksum.

Skill content

REPO="vilmire/discord-local-stt-tts" ... curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" ... curl -fL "$ZIP_URL" -o "$ZIP_PATH"

Recommendation

Run this only if you trust the GitHub repository and current release; consider reviewing the release or pinning a known version before installation.

Medium

#ASI05: Unexpected Code Execution

What this means

The installer may execute local build or package-manager code from the downloaded plugin and its dependencies.

Why it was flagged

If pnpm is installed, the script runs dependency installation and build commands inside the downloaded plugin directory, which can execute package/build scripts from that project.

Skill content

if command -v pnpm >/dev/null 2>&1; then ... (cd "$INSTALL_DIR" && pnpm i && pnpm -s build) || true

Recommendation

Review the upstream package files and build scripts if you want stronger assurance, or run the build steps manually in a controlled way.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Registry-level checks may not show all setup requirements before a user reads the skill instructions.

Why it was flagged

Registry metadata does not declare the source/homepage, macOS restriction, or required tools even though SKILL.md and the installer disclose them.

Skill content

Source: unknown; Homepage: none; OS restriction: none; Required binaries ... none

Recommendation

Read SKILL.md before running the installer and verify that you are on macOS with the required tools available.