MLX Audio Server

Local 24x7 OpenAI-compatible API server for STT/TTS, powered by MLX on your Mac.

This skill appears to do what it says (install a local MLX audio server and provide STT/TTS helpers), but take these precautions before installing: - Review the Homebrew tap/formula (guoqiao/tap) referenced by install.sh on GitHub to ensure the code and install steps are trustworthy. Third-party taps can install arbitrary software. - Prefer running install.sh manually yourself (inspect it line-by-line) rather than letting an agent run it autonomously. The script updates brew, installs packages, and starts a LaunchAgent service. - Because the skill is marked always: true, it will be force-included in every agent run; consider removing or disabling the skill unless you need that behavior. - No credentials are requested by the skill, and the runtime scripts only contact localhost for the API, but network activity to fetch the Homebrew tap and packages will occur. Only install on a machine you control and trust. If you want help auditing the Homebrew formula or reviewing the tap's repository, provide the tap URL and I can list the specific install actions to check.

Type: OpenClaw Skill Name: mlx-audio-server Version: 0.2.2 The skill is classified as suspicious primarily due to its reliance on an external Homebrew formula from a custom tap (`guoqiao/tap/mlx-audio-server`) in `install.sh`. This introduces a supply chain risk, as the content of this external formula is not part of the analyzed bundle and could potentially be altered or malicious. Additionally, the `install.sh` script establishes persistence by setting up `mlx-audio-server` as a LaunchAgent service on macOS, a high-risk capability, even though it aligns with the stated purpose of running a local 24x7 API server. While other scripts (`run_stt.sh`, `run_tts.sh`) only make local network calls to `localhost:8899`, the external dependency and persistence mechanism elevate the risk beyond benign.