Kokoro Tts Amx

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 0.1.0
• Hash: 2a21f264b2d01a6f87146929884b6eb44572197237dd0d67ec36d4a226d9edbc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides legitimate local text-to-speech functionality using Kokoro-82M, but it employs high-risk installation and execution patterns. The 'install.sh' script and 'README.md' promote the use of 'curl | bash' for installation and require 'sudo apt-get' permissions for system dependencies (espeak-ng). Furthermore, 'install.sh' dynamically clones repositories based on an environment variable (REPO_URL), which is a risky pattern that could be exploited to execute arbitrary code if the agent's environment is manipulated.