MoodCast
v1.0.2Transform any text into emotionally expressive audio with ambient soundscapes using ElevenLabs v3 audio tags and Sound Effects API
⭐ 3· 2.1k·3 current·3 all-time
byAshutosh Jha@ashutosh887
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill clearly targets ElevenLabs v3 TTS and a Sound Effects API and only asks for an ElevenLabs API key and a few optional MOODCAST_* env vars. One inconsistency: the registry metadata (summary at top) listed no required env vars, while the included SKILL.md and script require ELEVENLABS_API_KEY. This should be reconciled but does not indicate malicious intent.
Instruction Scope
SKILL.md instructs the agent/user to run the included Python script with CLI flags and to provide ELEVENLABS_API_KEY. The runtime instructions and examples reference only TTS, ambient generation, listing voices, and saving/playing files. There are no instructions to read unrelated files, system secrets, or to send data to unexpected endpoints; the only external network calls are to ElevenLabs APIs (as expected).
Install Mechanism
There is no formal install spec, which lowers the baseline risk. The script will attempt to pip-install the 'elevenlabs' package at runtime if it's missing (subprocess calling pip). That is a network operation and writes to disk at runtime — normal for Python scripts but potentially surprising to users. requirements.txt also lists elevenlabs>=1.0.0, which is consistent with the code.
Credentials
The only required secret is ELEVENLABS_API_KEY (declared in SKILL.md and used in the script). Optional MOODCAST_* env vars are sensible defaults. No unrelated credentials, config paths, or broad env access are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and only suggests (optionally) placing an apiKey in the Moltbot config. It writes temporary audio files and can save outputs when asked, which is expected behavior for a TTS tool.
Assessment
What to consider before installing: 1) This skill sends your provided text to ElevenLabs (TTS and Sound Effects APIs) — any content you process will be transmitted to that service; confirm you're comfortable with that and any privacy/cost implications. 2) You must provide ELEVENLABS_API_KEY; the SKILL.md declares this but the top-level registry metadata omitted it — verify required env vars before installing. 3) The script will attempt to pip-install the 'elevenlabs' package at runtime if missing (network + disk writes) — if you prefer, pre-install dependencies in a controlled environment. 4) The script creates temporary audio files and invokes local audio players (afplay/mpv/ffplay/aplay) when playing audio; these are normal but require appropriate local binaries. 5) Review the code if you plan to provide sensitive text or to add the API key to shared/global config; prefer per-agent or workspace installation and keep the API key scoped and rotated. If you need higher assurance, ask the maintainer to update the registry metadata to declare ELEVENLABS_API_KEY and to provide a vetted release URL or package.Like a lobster shell, security has layers — review code before you run it.
latestvk97ews9r8evwde4yt8jhdne8sn804mm1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.