Local Llama TTS

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward local text-to-speech wrapper, with only purpose-aligned local command use, file output, and user-directed model downloads to review.

This skill appears safe for its stated purpose. Before installing, make sure you trust the llama-tts binary and downloaded model files, and choose output paths carefully so generated WAV files do not overwrite anything important.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent can generate a local audio file, and a poorly chosen output path could overwrite an existing file.

Why it was flagged

The skill invokes a local command and writes to the selected output path. This is central to local TTS, but users should notice that the tool can create or overwrite the chosen WAV file; the optional speaker parameter is also expanded unquoted.

Skill content

llama-tts \
    -m "$MODEL" \
    -mv "$VOCODER" \
    -p "$TEXT" \
    -o "$OUTPUT" \
    ... \
    $SPEAKER_PARAM

Recommendation

Use an explicit safe output path, avoid unusual speaker filenames, and consider updating the script to pass speaker arguments as a quoted shell array.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

You need to trust the downloaded model and vocoder files before using them locally.

Why it was flagged

The setup depends on externally downloaded model files. This is expected for a local TTS skill, but the artifacts do not provide checksums or integrity verification steps.

Skill content

Download from [OuteAI/OuteTTS-1.0-0.6B-GGUF](https://huggingface.co/OuteAI/OuteTTS-1.0-0.6B-GGUF/resolve/main/OuteTTS-1.0-0.6B-Q4_K_M.gguf?download=true)

Recommendation

Download models only from trusted sources and verify hashes or signatures if the publisher provides them.