Clone any voice and generate speech using Coqui XTTS v2. SUPER SIMPLE - provide a voice sample (6-30 sec WAV) and text, get cloned voice audio. Supports 14+ languages. Use when the user wants to (1) Clone their voice or someone else's voice, (2) Generate speech that sounds like a specific person, (3) Create personalized voice messages, (4) Multi-lingual voice cloning (speak any language with cloned voice).
Security Analysis
medium confidenceThe skill's files implement a Docker-based voice-cloning workflow, but its runtime instructions and metadata contradict the implementation (undeclared required binaries, warnings not to use Docker while the provided script uses Docker), so there are incoherences you should resolve before trusting it with voice samples.
The skill claims to be a simple script-only voice-cloner and declares no required binaries or credentials, but the included script requires docker and ffmpeg and mounts host paths under /mnt/c/TEMP/Docker-containers/coqui-tts. Those binaries and path access are a legitimate need for the stated purpose, but they are not declared in the metadata and thus the manifest is inconsistent.
SKILL.md repeatedly tells agents 'DO NOT use Docker' and 'ONLY USE the script', yet scripts/clonev.sh runs docker run to perform synthesis and writes/copies files into host directories (/mnt/c/TEMP/...). This is a direct contradiction. The script will copy any user-specified WAV into the skill's voice-samples directory and write outputs to a host path — behavior that is expected for local processing but should be explicit and audited.
There is no install spec (instruction-only), which reduces install-scope risk. However the script invokes ghcr.io/coqui-ai/tts:latest which will be pulled by Docker at runtime if missing. Pulling an upstream container image from GHCR is expected for Coqui TTS, but it is a network-hosted binary download that the manifest does not advertise.
No environment variables or credentials are requested — appropriate for a local tool. However the script implicitly requires Docker and ffmpeg and writes to/reads from a specific host directory (/mnt/c/TEMP/Docker-containers/coqui-tts). Access to those filesystem locations is effectively required and should be disclosed; the skill does not declare or justify that host-path access in metadata.
The skill does not request always:true and does not attempt to modify other skills or system-wide configs. It stores model files and outputs under /mnt/c/TEMP/Docker-containers/coqui-tts, which is normal for model caching but note that it persists a ~1.87GB model and user samples on disk.
Guidance
Key things to consider before installing or running this skill: 1) Implementation vs instructions mismatch: SKILL.md explicitly warns not to use Docker, but the provided script runs 'docker run' and will pull ghcr.io/coqui-ai/tts:latest. Ask the author to clarify why the doc forbids Docker while the script depends on it. Do not trust the wording alone. 2) Undeclared local dependencies: The metadata lists no required binaries, but the script requires Docker and ffmpeg. Ensure those binaries are installed and review their versions. Prefer running the script in an isolated environment (VM or disposable container) first. 3) File-system and privacy implications: The script copies your provided WAV into /mnt/c/TEMP/Docker-containers/coqui-tts/voice-samples and writes outputs to /mnt/c/TEMP/Docker-containers/coqui-tts/output/. That means your voice samples and the generated model files are persisted on disk in that path. If you will clone other people’s voices, ensure you have consent and be aware of local storage of sensitive audio. 4) Container image source: The container image is pulled from GHCR (ghcr.io/coqui-ai/tts:latest), which is the official Coqui registry — that is expected. Still, inspect the command and consider pulling and inspecting the image separately before allowing the skill to run it in a privileged environment. 5) Run in sandbox first: Because of the contradictions and host-path writes, run the script in a sandboxed environment (separate user account, VM, or disposable instance) and inspect the resulting files and network activity before integrating into production agents. 6) Ask for fixes or clarifications: Request that the skill metadata be updated to list required binaries (docker, ffmpeg), that SKILL.md be corrected to reflect that the script uses Docker (or the script be modified to avoid Docker), and that output/model paths be configurable instead of hardcoded. If you cannot get satisfactory clarification or prefer not to expose voice samples and host paths, do not install or run this skill.
Latest Release
v1.0.0
Initial release of CloneV skill – voice cloning made simple. - Provides a one-command solution for cloning any voice and generating speech using Coqui XTTS v2. - Supports 14+ languages; easily specify language code for multi-lingual speech. - Requires a 6–30 second WAV voice sample and text; outputs an OGG file with cloned voice. - Strict instructions: use only the included `scripts/clonev.sh` script (no direct Docker/API use). - Detailed usage, troubleshooting, and reference provided in SKILL.md for quick, efficient deployment.
Popular Skills
Published by @instant-picture on ClawHub
