Deapi Audio

This skill appears to do what it says, but review and consider these practical risks before installing: - Provide the API key via environment variable (DEAPI_API_KEY) rather than saving it in the skill's config.json if you want less disk-persistent exposure. If you do use config.json be aware the API key is stored in plaintext under the skill directory. - The scripts download user-supplied URLs (ref-audio, audio). Do not provide internal or sensitive endpoints (e.g., http://169.254.x.x, internal cloud metadata endpoints, or private intranet URLs) because the skill will fetch them and may upload content to the external deAPI service. This is an expected capability for remote-audio support but is an SSRF/exfiltration risk if misused. - The scripts log API responses to stderr on some errors; sensitive response payloads could appear in agent logs. Rotate the API key if it's ever exposed. - Voice cloning involves uploading sample audio — consider privacy and legal implications before cloning someone else's voice. If you need stronger guarantees: keep the key in a protected secret store, avoid providing internal URLs as inputs, inspect the scripts locally before use, and monitor/network-restrict the runtime environment if you want to limit outbound fetches.