Manifest
    by Manifold
    Back to Results

    sherpa-onnx-tts

    Local text-to-speech via sherpa-onnx (offline, no cloud)

    content-and-media›audio-processing
    Rank#2900
    openclawgithubCli wrapper391,537Last updated Oct 6, 2026, 02:56 PMgithub/openclaw/openclaw/skills/sherpa-onnx-tts
    Created
    11 months ago
    Last commit
    16 hours ago
    Latest release
    v2026.9.92 days ago

    Security Findings

    Unpinned dependencies

    SuspiciousLineage

    2 unpinned: @openclaw/ai, @openclaw/session-url-contract

    Workflow makes outbound network call

    SuspiciousLineage

    [.github/workflows/ci.yml] curl -fsS --connect-timeout 2 --max-time 5 -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/l

    pull_request_target with secrets

    MaliciousLineage

    [.github/workflows/auto-response.yml] pull_request_target with secrets

    Skill prose instructs agent to follow opaque artifact5×

    SuspiciousAnalyzer

    SKILL.md instructs agent ('tar') to follow opaque artifact sherpa-onnx-v1.13.6-osx-universal2-shared.tar.bz2

    SKILL.md instructs agent ('tar') to follow opaque artifact tar.bz2

    SKILL.md instructs agent ('tar') to follow opaque artifact sherpa-onnx-v1.13.6-linux-x64-shared.tar.bz2

    SKILL.md instructs agent ('tar') to follow opaque artifact sherpa-onnx-v1.13.6-win-x64-shared-md-release.tar.bz2

    SKILL.md instructs agent ('tar') to follow opaque artifact vits-piper-en_us-lessac-high.tar.bz2

    OWASP-AST01OWASP-AST02

    Environment variable hijacking

    SuspiciousAnalyzer

    Runtime-injection env var in content: .LD_LIBRARY_PATH = p

    OWASP-AST06

    Versions

    2
    • Scanned Oct 6, 2026, 02:56 PMMedium
    • Scanned Aug 4, 2026, 08:53 AMMedium