Whisper Piper Voice

Set up and run a local voice pipeline combining Whisper STT (speech-to-text) and Piper TTS (text-to-speech) as a single HTTP server. Use when asked to set up...

This skill appears to do what it claims, but take these precautions before installing and running the server: 1) By default the server binds 0.0.0.0 and has no authentication — restrict it to localhost or put it behind a reverse proxy with auth (or firewall rules) if you will expose it on a network. 2) Run the service as an unprivileged user (as in the systemd example) and avoid running as root. 3) Verify downloaded artifacts (piper binary and voice models) come from the official project pages/releases and review license terms for model use. 4) Consider rate-limiting or network controls; the server spawns subprocesses (piper, ffmpeg) for each request and has no built-in quotas, so untrusted input or heavy traffic could exhaust resources. 5) If you need remote access, add TLS and authentication (reverse proxy or API key) — do not expose the plain HTTP endpoints to the open internet.

Type: OpenClaw Skill Name: whisper-piper-voice Version: 1.0.0 The skill implements a local STT/TTS HTTP server that contains several security vulnerabilities. Specifically, 'scripts/voice-server.py' uses the deprecated and insecure 'tempfile.mktemp()' function, which is susceptible to race conditions and symlink attacks. Additionally, the server binds to all network interfaces ('0.0.0.0') without any authentication mechanism, potentially exposing the host to unauthorized access. While these behaviors appear to be unintentional flaws rather than malicious intent, they represent significant security risks in a networked environment.