VibeVoice TTS

Local Spanish TTS using Microsoft VibeVoice. Generate natural voice audio from text, optimized for WhatsApp voice messages.

This skill is internally consistent with its stated purpose, but before installing consider: (1) The runtime will likely download large model weights from Hugging Face (microsoft/VibeVoice-Realtime-0.5B) unless you already have them locally — expect heavy network use and large disk usage. (2) Installing torch/torchaudio can be large and may require CUDA/tooling matching your GPU; follow official install docs for your environment. (3) The skill runs local Python code which will execute on your machine — only install from trusted sources and inspect the VibeVoice repo you clone. (4) No credentials are required, but ensure you have sufficient GPU/VRAM, disk space, and bandwidth. If you want to be stricter, clone and verify the upstream microsoft/VibeVoice repository yourself and run the script in an isolated environment (container or dedicated VM).

Type: OpenClaw Skill Name: vibevoice Version: 1.0.0 The skill is classified as suspicious due to multiple critical shell injection vulnerabilities in `scripts/vv.sh`. User-controlled variables like `$VOICE`, `$SPEED`, and `$OUTPUT` are directly embedded into a Python heredoc and `ffmpeg` commands without proper sanitization, allowing for arbitrary command execution. Additionally, the `-f` argument allows reading arbitrary files, which could be combined with the shell injection for data exfiltration. While there is no clear evidence of intentional malicious behavior (e.g., self-exfiltration or backdoors), these severe vulnerabilities pose a significant security risk.