Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Chinese Voice Detective Mystery Game

中文语音侦探推理游戏。适用于用户想玩一场沉浸式推理探案的场景:由 LLM 生成包含嫌疑人、线索和真凶的完整案件,玩家通过审讯嫌疑人(支持 ASR 语音或文本输入)、勘察现场、收集证据,最终提出指控并获得评分。支持多音色 TTS 为不同嫌疑人配音,审讯历史自动压缩防止上下文溢出,案件生成后自动验证逻辑自洽性。支持存...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
1 · 21 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill legitimately needs LLM/TTS/ASR access (it calls remote LLM, TTS, and ASR endpoints). However the registry metadata declares no required environment variables while both SKILL.md and the script expect MYSTERY_LLM_API_KEY (fallback IME_MODEL_API_KEY), MYSTERY_TTS_API_KEY (fallback SENSEAUDIO_API_KEY), and MYSTERY_ASR_API_KEY (fallback SENSEAUDIO_API_KEY). That metadata omission is an incoherence users should be aware of.
Instruction Scope
SKILL.md and scripts stick to the stated game functions (generate case via LLM, TTS playback, ASR transcription, save game/report). The runtime will read environment variables and optionally load .env files from the skill or current directory, write outputs (MP3, case_report.json) to an outputs/ folder, and post audio/text to external LLM/TTS/ASR endpoints — all within the described scope but worth noting.
Install Mechanism
There is no external download/install spec; the package is instruction + included Python script and a requirements.txt (openai, requests, python-dotenv). No arbitrary remote code download is specified. Installation risk is typical for a Python script that makes network calls.
!
Credentials
The script requires API keys for LLM/TTS/ASR which is proportionate to the functionality. Concerns: default endpoints point to third‑party hosts (models.audiozen.cn and api.senseaudio.cn) rather than a well-known public provider; the code will accept fallbacks (IME_MODEL_API_KEY and SENSEAUDIO_API_KEY), potentially picking up unrelated keys from the user's environment. The skill will send audio and prompt text to those endpoints — verify you trust them and avoid reusing high‑privilege or billing‑sensitive API keys.
Persistence & Privilege
always is false and the skill does not request system-wide privileges or modify other skills. It writes files to a local outputs/ directory and may load .env files from the skill directory or CWD — normal for a local script but users should be aware it will create files in the working directory.
What to consider before installing
This skill appears to implement the advertised game, but before installing: (1) inspect the script yourself (it is included) and confirm the network endpoints (models.audiozen.cn, api.senseaudio.cn) are services you trust; (2) do not supply high‑privilege or unrelated API keys—create limited/sandbox keys for LLM/TTS/ASR usage; (3) be aware the script will read environment variables and .env files in the skill and current directory and will transmit audio and prompt text to the configured endpoints; (4) run the skill in an isolated environment (VM or container) if you want to limit potential data exposure; and (5) ask the publisher to correct the registry metadata to list the required environment variables explicitly before using in production.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
asrvk97a4affw2jfsk2f6px8zz78jd831ckbchinesevk97a4affw2jfsk2f6px8zz78jd831ckbdetectivevk97a4affw2jfsk2f6px8zz78jd831ckbgamevk97a4affw2jfsk2f6px8zz78jd831ckbinteractivevk97a4affw2jfsk2f6px8zz78jd831ckblatestvk97a4affw2jfsk2f6px8zz78jd831ckbttsvk97a4affw2jfsk2f6px8zz78jd831ckb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

中文语音侦探推理游戏

适用范围

此 Skill 用于运行一场完整的中文侦探推理互动游戏。

能力边界:

  • 依赖 LLM 生成案件和角色对话,TTS 合成多角色语音,ASR 识别玩家语音输入
  • 支持审讯、勘察、回顾证据、指控四种动作
  • 支持存档/读档,跨会话保持游戏进度
  • 案件生成后自动验证逻辑自洽性

不做:

  • 视频或图像生成
  • 英文游戏
  • 实时打断式流式语音对话

默认配置

  • difficulty: medium(easy/medium/hard)
  • max_turns: 30
  • 每位嫌疑人最多 5 轮审讯
  • 审讯历史超 4 轮自动压缩

音色分配

角色voice_idspeedpitch
旁白 narratorchild_0001_a0.85-1
嫌疑人A suspect_amale_0004_a1.00
嫌疑人B suspect_bmale_0018_a1.10
嫌疑人C suspect_cchild_0001_b1.02

玩家动作

  • interrogate — 审讯嫌疑人(选择对象,多轮对话)
  • examine — 勘察现场(发现新线索)
  • review — 回顾已收集的证据
  • accuse — 提出指控(输入推理,获得评分)
  • save — 保存游戏进度
  • quit — 退出游戏

评分维度

维度分值范围说明
logic0-30推理逻辑是否严密
evidence0-30证据引用是否充分
completeness0-20是否涵盖关键线索
efficiency0-20用了多少步得出结论
总分0-100

工作流

  1. 初始化

    • 读取难度、最大回合数等参数
    • --load 则加载存档
  2. 案件生成

    • LLM 生成案件背景、3名嫌疑人、证据线索、真凶
    • 自动验证:恰好1个真凶、线索关联完整
    • 不通过则重试(最多3次)
  3. 开场旁白

    • TTS 播放案件简介
  4. 主循环

    • 玩家选择动作 → 系统处理 → TTS 返回
    • interrogate: 多轮对话,嫌疑人用角色音色
    • examine: 发现线索,旁白描述
    • accuse: 输入推理 → 评分 → 揭示真相
  5. 输出

    • case_report.json: 完整案件和游戏记录

Prompt 模块

详见 references/prompts_cn.md

数据结构

详见 references/state_schema_cn.md

直接运行

pip install -r requirements.txt

# 文本模式(不用 ASR)
python scripts/run_mystery.py --no-asr

# 完整语音模式
python scripts/run_mystery.py

# 高难度
python scripts/run_mystery.py --difficulty hard --no-asr

# 读取存档
python scripts/run_mystery.py --load --no-asr

# 不用 TTS
python scripts/run_mystery.py --no-tts --no-asr

接口约定:

  • LLM 读取 MYSTERY_LLM_API_KEY,回退到 IME_MODEL_API_KEY
  • TTS 读取 MYSTERY_TTS_API_KEY,回退到 SENSEAUDIO_API_KEY
  • ASR 读取 MYSTERY_ASR_API_KEY,回退到 SENSEAUDIO_API_KEY

Files

7 total
Select a file
Select a file to preview.

Comments

Loading comments…