Kokoro Tts Amx

PassAudited by ClawScan on May 12, 2026.

Overview

This appears to be a coherent local text-to-speech skill, with the main caution that its setup can run package installers and an optional remote GitHub installer.

This skill looks reasonable for local TTS. Before installing, review the setup commands, be comfortable with system/Python package installation and the Hugging Face model download, and prefer a reviewed or pinned install path over the optional curl-to-bash command.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the agent performs setup, it may install or update packages on the machine.

Why it was flagged

The skill allows the agent to run Python and package-management commands. This is aligned with installing and running a local TTS stack, but users should recognize that these commands can modify the local environment.

Skill content

allowed-tools: Bash(python *), Bash(pip *), Bash(apt-get *), Bash(source *), Bash(cd *)

Recommendation

Approve setup commands deliberately, and prefer running them in the skill directory or a controlled environment.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A future change to the remote GitHub script could run different installation code than the artifact reviewed here.

Why it was flagged

The optional one-line installer executes a live script from a GitHub main branch rather than a pinned, registry-reviewed artifact. This is disclosed and purpose-aligned, but it is a supply-chain point users should review.

Skill content

curl -fsSL https://raw.githubusercontent.com/Wray151/xeontts/main/install.sh | REPO_URL=https://github.com/Wray151/xeontts bash

Recommendation

Prefer cloning/reviewing the repository or pinning a commit before running the remote installer; avoid curl-to-bash if you do not trust the source.