speaker-local

Text-to-speech using Kokoro local TTS. Use when the user wants to convert text to audio, read aloud, or generate speech.

This skill appears to be a wrapper for the third-party Kokoro TTS CLI and requires downloading model files and installing a tool, but the registry metadata omits those runtime requirements. Before installing or using: 1) verify the kokoro-tts project and release assets on GitHub are the genuine upstream (owner nazdridoy) and inspect release checksums if available; 2) confirm what 'uv tool install kokoro-tts' actually does (review its code or use a manual install) — unknown installers can run arbitrary commands; 3) ensure required runtime binaries (kokoro-tts, Python 3.9–3.12, wget or equivalent) are present and declared in metadata; 4) avoid running installers or executing downloaded model files from untrusted sources; 5) if you need higher assurance, request the skill author add explicit required-binaries and an install spec (or provide vetted package URLs / checksums). If you cannot verify the installer and release assets, treat the skill as untrusted.

Type: OpenClaw Skill Name: speak1 Version: 1.0.0 The skill bundle is classified as suspicious due to its reliance on external network requests to download and install components. Specifically, the `SKILL.md` instructs the agent to use `uv tool install kokoro-tts` to install the main tool and `wget` commands to download binary model files (`kokoro-v1.0.onnx`, `voices-v1.0.bin`) from a GitHub repository. While these actions are plausibly needed for the stated purpose of a local TTS tool, they introduce supply chain risks by fetching and trusting external binaries, which could be compromised. This constitutes a 'risky capability' without clear malicious intent, aligning with the 'suspicious' classification.