oma-voice — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-voice (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Drive the Voicebox local app through its MCP server so any MCP-aware agent can speak (TTS) or listen (STT) without invoking cloud vendors. The skill standardizes intent routing, voice profile resolution, output layout, and guardrails while voicebox itself owns the engines, voice cloning UI, captures archive, and stories editor.
$CWD), optional language hint.mp3 default, wav optional) at .agents/results/voice/{timestamp}-{shortid}/output.{mp3|wav} plus manifest.json.transcript.md at .agents/results/voice/transcripts/{timestamp}-{shortid}/ plus manifest.json.claude mcp add --transport http voicebox http://127.0.0.1:17493/mcp).GET /health as the handshake probe.tools/list.GET /health.tools/list and cache the resolved tool names.manifest.json alongside the output. Report the path or transcript to the user.voicebox_list_profiles is empty, point the user at the Voicebox app UI to create a profile, then exit.| Failure | Recovery |
|---|---|
| Voicebox app not running | Print install/launch hint, exit code 5 |
| No voice profile | Print "create a profile in Voicebox" hint, exit code 3 |
| Engine model missing | Ask before triggering download |
Output path outside $PWD | Warn the user, require explicit confirmation |
| TTS over 5000 chars | Ask the user to split or truncate |
| STT over 30 minutes | Ask the user to confirm |
| MCP tool name drift | Re-run tools/list and update the cache |
| SIGINT | Abort the MCP call, write no partial output |
| Action | SSL primitive | Evidence |
|---|---|---|
| Validate mode and inputs | VALIDATE | Clarification protocol in execution-protocol.md |
| Resolve voice profile | SELECT | voicebox_list_profiles + config defaults |
| Health check | READ | MCP handshake or GET /health |
| Generate speech | CALL_TOOL | MCP voicebox_speak |
| Transcribe audio | CALL_TOOL | MCP voicebox_transcribe |
| Write output and manifest | WRITE | Audio or transcript plus manifest.json |
| Inspect result | VALIDATE | Output presence, duration, manifest fields |
| Report result | NOTIFY | Final user-facing summary |
http://127.0.0.1:17493/mcp.GET /health, GET /audio/{generation_id}).# 1. MCP handshake or REST health
GET http://127.0.0.1:17493/health -> 200 OK
# 2. Discover tool names on first run
MCP tools/list -> cache real names
# 3. Resolve profile
MCP voicebox_list_profiles -> pick profile by name or config default
# 4. Generate or transcribe
MCP voicebox_speak { text, profile, language?, engine?, personality? }
MCP voicebox_transcribe { audio_path | audio_base64, language?, model? }
# 5. Persist output + manifest
.agents/results/voice/<timestamp>-<shortid>/output.mp3 + manifest.json
.agents/results/voice/transcripts/<timestamp>-<shortid>/transcript.md + manifest.json| Use case | MCP tool | REST backing |
|---|---|---|
| TTS generation | voicebox_speak | POST /generate |
| STT transcription | voicebox_transcribe | POST /transcribe |
| Profile listing | voicebox_list_profiles | GET /profiles |
| Captures listing | voicebox_list_captures | GET /history (captures view) |
Tools not exposed via MCP (REST only): model status (GET /models/status), audio file serving (GET /audio/{generation_id}). The skill calls those over loopback HTTP when needed.
Notes on `voicebox_speak`:
text. Optional: profile, engine, language, personality (bool).save_to_disk toggle on the MCP tool itself.profile= is required.Notes on `voicebox_transcribe`:
audio_base64 or audio_path (loopback only). Optional language, model.| Scope | Resource target |
|---|---|
LOCAL_FS | Input audio, generated audio, transcripts, manifests |
PROCESS | Local Voicebox app subprocess (managed by the user) |
NETWORK | Loopback HTTP to 127.0.0.1:17493 only |
MEMORY | Cached MCP tool names, resolved profile metadata |
CREDENTIALS | None. Voicebox is local and key-free. |
$PWD unless explicitly allowed..agents/results/voice/.GET /health fails, exit with a one-shot install or launch hint. Do not retry, do not auto-relaunch.voicebox_list_profiles returns empty, instruct the user to create a profile in the Voicebox app (Profiles tab → + New Profile → pick Kokoro preset for the fastest path), then exit.tools/list and cache the resolved names. Reuse the cache for subsequent calls in the same session.auto_notify_after_sec (default 60s). Always announce intent in one short line before generating audio.$PWD, warn once and require explicit confirmation.manifest.json with at minimum: skill, mode, voicebox_generation_id, text (or transcript_preview), profile, engine, language, format (TTS only), created_at.oma-image does not apply.Before invoking a TTS or STT call, the agent checks the following. If any required signal is missing, clarify with the user first.
TTS (asset mode) required:
TTS strongly recommended:
STT required:
Notification mode skips clarification. It uses notification_profile from config and language is auto-detected from the message.
#### Standalone
/oma-voice "build succeeded, 4 minor warnings"
/oma-voice transcribe ~/Downloads/standup.m4a
/oma-voice --profile prof_warm_korean "다음 단계 진행 준비됐어요"#### Shared infrastructure (other skills)
Other skills can request audio output by calling the same MCP tools directly, or by invoking /oma-voice with their text. There is no separate CLI; the skill is MCP-native.
resources/voice-matrix.mdresources/prompt-tips.mdresources/execution-protocol.mdresources/checklist.mdconfig/voice-config.yaml../_shared/core/context-loading.md../_shared/core/quality-principles.md../../../docs/plans/designs/012-oma-voice.md (source repo only; absent in global-mode installs)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.