The executable code is straightforward: it validates runtime/model paths, locates required files, sets library search paths, and launches a local TTS binary with explicit arguments.

Several automated detections overstate the risk here because they match normal implementation details such as spawning a subprocess and adjusting LD_LIBRARY_PATH for a bundled native runtime.

The real security consideration is supply chain exposure from downloading prebuilt binaries and models from external URLs during installation.

The wrapper can write output files to arbitrary user-chosen locations, but that is expected for a command-line TTS tool and not evidence of malicious behavior by itself.

I did not find hooks, shell lifecycle scripts, credential reads, scanner-evasion text, or active network exfiltration in the provided executable files.