Alicloud Ai Audio Cosyvoice Voice Clone

Use when creating cloned voices with Alibaba Cloud Model Studio CosyVoice customization models, especially cosyvoice-v3.5-plus or cosyvoice-v3.5-flash, from...

Security Scan

The skill appears to be what it claims (helpers to prepare CosyVoice enrollment requests) but its declared metadata omits required credentials/config and there are small scope/metadata inconsistencies the user should verify before installing.

Purpose & Capability

The skill's purpose (prepare CosyVoice voice-enrollment requests) is consistent with included files and references to Alibaba Cloud endpoints. However the SKILL.md requires an API key or credential entry (DASHSCOPE_API_KEY or dashscope_api_key in ~/.alibabacloud/credentials) while the registry metadata lists no required environment variables or primary credential — an inconsistency that should be resolved.

Instruction Scope

Runtime instructions are narrowly scoped to creating a normalized enrollment JSON and saving evidence to an output folder. They require a public audio URL and tell the user to include that URL in output artifacts (privacy/consent implication). The instructions do not tell the agent to read unrelated system files or exfiltrate secrets.

Install Mechanism

No install spec; skill is instruction-plus-a-small-helper-script. The included Python script only builds and writes JSON and optionally validates a response file — nothing is downloaded or executed from external URLs during install.

Credentials

SKILL.md explicitly instructs setting DASHSCOPE_API_KEY or adding dashscope_api_key to ~/.alibabacloud/credentials, but the skill metadata declares no required env vars or primary credential. Requesting an API key (and storing/using it) would be proportionate for this provider integration, but the omission in metadata is a mismatch and could mislead users about required secrets.

Persistence & Privilege

always is false and the skill does not request persistent/autonomic privileges. It writes only to an output directory within the skill workspace as documented — expected for a helper.

What to consider before installing

This skill is a local helper for preparing Alibaba Cloud CosyVoice enrollment requests and the included Python script only writes JSON; nothing in the code is overtly malicious. However, SKILL.md says you must set DASHSCOPE_API_KEY or add dashscope_api_key to ~/.alibabacloud/credentials, yet the registry metadata lists no required credentials — ask the publisher to correct the metadata. Before installing: (1) confirm how and where the enrollment request will actually be submitted (the script does not call the API), and whether the agent or another component will transmit your API key to the Alibaba endpoint; (2) be aware that the skill instructs storing the sample URL and other evidence in an output folder — that may expose sensitive or private audio links; (3) only provide an Alibaba API key with least privilege and rotate/revoke it if you stop using the skill; (4) if you need stronger assurance, request a version that performs the authenticated API call in a transparent way (showing how the key is used) or update the skill metadata to declare required env vars so you can review permission prompts.

Category: provider

Model Studio CosyVoice Voice Clone

Use the CosyVoice voice enrollment API to create cloned voices from public reference audio.

Critical model names

Use model="voice-enrollment" and one of these target_model values:

• cosyvoice-v3.5-plus
• cosyvoice-v3.5-flash
• cosyvoice-v3-plus
• cosyvoice-v3-flash
• cosyvoice-v2

Recommended default in this repo:

• target_model="cosyvoice-v3.5-plus"

Region and compatibility

• cosyvoice-v3.5-plus and cosyvoice-v3.5-flash are available only in China mainland deployment mode (Beijing endpoint).
• In international deployment mode (Singapore endpoint), cosyvoice-v3-plus and cosyvoice-v3-flash do not support voice clone/design.
• The target_model used during enrollment must match the model used later in speech synthesis, otherwise synthesis fails.

Endpoint

• Domestic: https://dashscope.aliyuncs.com/api/v1/services/audio/tts/customization
• International: https://dashscope-intl.aliyuncs.com/api/v1/services/audio/tts/customization

Prerequisites

• Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.
• Provide a public audio URL for the enrollment sample.

Normalized interface (cosyvoice.voice_clone)

Request

• model (string, optional): fixed to voice-enrollment
• target_model (string, optional): default cosyvoice-v3.5-plus
• prefix (string, required): letters/digits only, max 10 chars
• voice_sample_url (string, required): public audio URL
• language_hints (array[string], optional): only first item is used
• max_prompt_audio_length (float, optional): only for cosyvoice-v3.5-plus, cosyvoice-v3.5-flash, cosyvoice-v3-flash
• enable_preprocess (bool, optional): only for cosyvoice-v3.5-plus, cosyvoice-v3.5-flash, cosyvoice-v3-flash

Response

• voice_id (string): use this as the voice parameter in later TTS calls
• request_id (string)
• usage.count (number, optional)

Operational guidance

• For Chinese dialect reference audio, keep language_hints=["zh"]; control dialect style later in synthesis via text or instruct.
• For cosyvoice-v3.5-plus, supported language_hints include zh, en, fr, de, ja, ko, ru, pt, th, id, vi.
• Avoid frequent enrollment calls; each call creates a new custom voice and consumes quota.

Local helper script

Prepare a normalized request JSON:

python skills/ai/audio/alicloud-ai-audio-cosyvoice-voice-clone/scripts/prepare_cosyvoice_clone_request.py \
  --target-model cosyvoice-v3.5-plus \
  --prefix myvoice \
  --voice-sample-url https://example.com/voice.wav \
  --language-hint zh

Validation

mkdir -p output/alicloud-ai-audio-cosyvoice-voice-clone
for f in skills/ai/audio/alicloud-ai-audio-cosyvoice-voice-clone/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/alicloud-ai-audio-cosyvoice-voice-clone/validate.txt

Pass criteria: command exits 0 and output/alicloud-ai-audio-cosyvoice-voice-clone/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/alicloud-ai-audio-cosyvoice-voice-clone/.
• Include target_model, prefix, and sample URL in the evidence file.

References

• references/api_reference.md
• references/sources.md