Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it says: sends user-provided text to a configured Windows TTS server, with some privacy and local-network setup risks users should understand.
Install only if you control the Windows TTS server and network. Avoid sending private medical, financial, credential, or sensitive household details through TTS, prefer HTTPS or authentication if supported, keep the server off the public Internet, and review any heartbeat or cron reminders before enabling automated broadcasts.
client.ts:87Unauthenticated Plaintext Transport for TTS Commands
package-lock.json:18Build Dependencies Retrieved from a Non-Official Registry Mirror
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
clawhub uninstall windows-tts
rm -rf /home/cmos/.openclaw/extensions/windows-tts
## 更新
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
clawhub uninstall windows-tts
rm -rf /home/cmos/.openclaw/extensions/windows-tts
## 更新
The declared purpose describes an end-user messaging and audio output skill involving Azure TTS and Bluetooth speakers. The actual code chunk is only a TypeScript declaration file for configuration typing and validation. Based on the supplied code, the primary described functionality is not represented at all. While config validation could be a supporting implementation detail, this chunk by itself does not evidence any of the advertised capabilities, so the description does not accurately match the observed behavior.
The declared purpose describes a concrete end-user notification/audio broadcasting skill. However, the supplied code chunk is only a type declaration for a validation function in guards.d.ts. This indicates configuration/schema checking behavior, not text-to-speech delivery or Bluetooth broadcasting. Based on the supplied code, the actual behavior is materially different from the description, so this is a mismatch.
The declared description says the skill sends text notifications to Azure TTS for Bluetooth audio broadcast. However, the supplied code does not implement notification delivery, text-to-speech, Azure integration, Bluetooth communication, alarms, or announcements. It is solely a deployment/publishing script for releasing the skill to ClawHub. That is a materially different primary purpose, so this is a clear mismatch.
The documentation describes reminders and notifications but does not clearly warn that reminder text is transmitted over the network to a separate Windows TTS server at a specific LAN address. Users may unknowingly send private family, medical, or scheduling information to another host, increasing privacy risk and the chance of interception or mishandling.
The invocation examples encourage broad natural-language triggering such as asking an agent to 'remind the child to do homework' without defining scope, authorization, or confirmation boundaries. In an agent ecosystem, this can cause unintended TTS broadcasts, prompt-trigger abuse, or misuse by other agents/users who can induce announcements containing sensitive or disruptive content.
The example explicitly sends text via HTTP POST to a separate host on the local network, demonstrating external transmission of user-supplied content. Because the transport shown is plain HTTP and the content may include personal reminders, anyone with local network visibility or access to the target service could observe or misuse the transmitted data.
# 测试连接
curl -X POST http://192.168.1.60:5000/play_tts \
-H "Content-Type: application/json" \
-d '{"text": "测试"}'
The installation and usage instructions are presented entirely in Chinese, which can amount to a language policy issue when the skill documentation forces a specific language without user choice. The file does not indicate that Chinese is optional, nor does it offer an alternative locale version.
The documentation includes a direct token-based login example using clawhub login --token YOUR_API_TOKEN, but it does not warn that passing secrets on the command line can expose them through shell history, terminal logging, or process inspection. In a publishing workflow, this increases the chance that a real registry credential is unintentionally leaked during normal operator use.
The publishing summary promotes LAN-wide voice broadcast and family reminder use cases but does not warn that spoken content may be overheard by unintended listeners nearby or on connected speakers. In this skill context, announcements may contain sensitive household information such as medication reminders, schedules, or personal names, so missing privacy guidance increases the risk of accidental disclosure.
This markdown file is natural-language documentation, and it consistently forces a single language/locale for all instructions and user-facing content. Under the policy, language-specific guidance should either offer user opt-in/choice or clearly document a justified regional constraint, neither of which appears here.
The README centers the workflow around Chinese reminder content and zh-CN voices, and the operational examples are all presented in Chinese. Although English voices are listed later, the skill does not state that users may choose their preferred language or that the Chinese locale is an intentional region-specific constraint.
This markdown file documents a network call to a local HTTP endpoint using curl, which transmits reminder content over the network. The surrounding text presents it as a quick test but does not warn that reminder content will be sent to another device/service or mention any privacy considerations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 测试 TTS 连接
curl -X POST http://192.168.1.60:5000/play_tts \
-H "Content-Type: application/json" \
-d '{"text": "测试一下，这里是跨设备自动播报系统。"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 测试 TTS 连接
curl -X POST http://192.168.1.60:5000/play_tts \
-H "Content-Type: application/json" \
-d '{"text": "测试一下，这里是跨设备自动播报系统。"}'
The skill clearly describes network communication with a Windows-hosted HTTP TTS server, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: an agent or platform may permit undeclared network access, and users are not clearly warned that their text will be transmitted off-host to another machine for playback.
The skill encourages sending reminder text to a Windows HTTP endpoint for immediate audible playback, but the user-facing description lacks a clear warning about transmission over the network and the privacy implications of speaking messages aloud. This can expose sensitive household, medical, or scheduling information to interception on the network or unintended listeners in the physical environment.
The client defaults to "zh-CN-XiaoxiaoNeural", which implicitly fixes output to a Chinese locale when the user does not choose a voice. This is a natural-language locale constraint with no opt-in or documented justification in the file.
The notify method sends input.text, voice, and volume to a remote service via POST /play_tts. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that user-provided content is transmitted over the network.
The client hard-codes zh-CN-XiaoxiaoNeural as the default voice, which imposes a specific language/locale choice when the caller does not supply one. This is a natural-language policy concern because the skill does not offer an explicit opt-in or neutral default for language selection.
The manifest sets the default voice to "zh-CN-XiaoxiaoNeural", which implicitly forces Chinese locale output unless the user overrides it. This is a natural-language locale policy concern because the skill does not indicate any user choice or opt-in for language selection.
The manifest hard-codes zh-CN-XiaoxiaoNeural as the default voice, which imposes a specific language/locale choice on users. The file does not indicate that users are asked to opt in to this locale or that the skill is intentionally limited to a Chinese-language context.
This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that users may choose another language or that the guide is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.
This markdown file includes direct instructions to edit /home/cmos/.openclaw/openclaw.json and copy files into /home/cmos/.openclaw/extensions, which affect local application configuration and filesystem state. The guide does not include any warning to back up existing configuration or note that these changes modify the user's local OpenClaw setup.
Detected: suspicious.destructive_delete_command