Text To Speech

Convert text to natural speech with DIA TTS, Kokoro, Chatterbox, and more via inference.sh CLI. Models: DIA TTS (conversational), Kokoro TTS, Chatterbox, Hig...

This skill appears to be a simple wrapper around the inference.sh CLI (TTS) and is not obviously malicious, but there are a few practical risks to consider before installing or invoking it: - Avoid blindly running curl https://cli.inference.sh | sh. Instead, fetch the installer script first, inspect it, and run it only after review. The example command executes remote code without local verification. - The SKILL.md claims checksum verification, but the provided example does not perform an explicit checksum check. If you install, verify the downloaded binary's SHA-256 against the project-provided checksums (https://dist.inference.sh/cli/checksums.txt) before executing. - Expect to authenticate to inference.sh (infsh login). The skill metadata does not declare required credentials or tokens, so be prepared that the CLI will request/store credentials locally and communicate with external servers. - If you have sensitive data or a high-security environment, consider running the installer and CLI inside a sandboxed VM or container and limit network access until you've vetted the service and its privacy policy. - Verify the inference.sh domain and project reputation (source code, repo, or official docs) before trusting it with your content and credentials. If you want a lower-risk option, look for a skill that uses a pre-approved package manager install or one that declares required credentials up front and provides reproducible verification steps.

Type: OpenClaw Skill Name: text-to-speech Version: 0.1.5 The skill is classified as suspicious due to the use of `curl -fsSL https://cli.inference.sh | sh` for installing the `infsh` CLI in `SKILL.md`. While this is a common installation method for CLI tools and the documentation attempts to reassure about its safety, executing a remote script directly via `curl | sh` introduces a significant supply chain vulnerability. If `cli.inference.sh` were compromised, it could lead to arbitrary code execution on the agent's system, representing a critical RCE risk without clear malicious intent from the skill itself.