Back to skill
Skillv1.0.0
ClawScan security
Kid Point Voice Component · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewMar 15, 2026, 2:53 AM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill appears to implement the claimed TTS/ASR functionality, but there are inconsistencies (missing declared env requirements, mixed package metadata, and hard-coded config paths) that merit caution before installing.
- Guidance
- This skill mostly does what it claims (TTS+ASR) but has a few red flags you should check before installing: 1) The scripts expect a SENSE_API_KEY (read from SENSE_API_KEY env or ~/.openclaw/openclaw.json) but the skill metadata does not declare this — confirm you are comfortable storing your API key in openclaw.json or as an env var. 2) The code attempts to read ~/.openclaw/agents/kids-study/openclaw.json (hard-coded agent path) — verify that file doesn't contain other secrets you don't want accessed. 3) package.json looks inconsistent (Node manifest listing Python packages) — ensure your install process won't run unexpected installers. 4) Review network endpoints (https://api.senseaudio.cn and Edge TTS usage) and confirm you trust the providers. 5) Run setup and the scripts in a sandbox or isolated environment first and inspect any files written under the derived workspace/audio path. If you need higher assurance, ask the publisher to update the registry metadata to declare SENSE_API_KEY as a required credential and to remove or justify the hard-coded agent config path.
Review Dimensions
- Purpose & Capability
- noteThe code and SKILL.md match the stated purpose (SenseAudio TTS + ASR, Edge TTS fallback). However the registry metadata declares no required environment variables or credentials while the scripts clearly require a SENSE_API_KEY for SenseAudio access — this metadata omission is inconsistent and should be corrected.
- Instruction Scope
- noteRuntime instructions/scripts mostly stay within expected scope (call SenseAudio endpoints, optionally use edge-tts, save audio files, detect/play via local players). The scripts read configuration from ~/.openclaw/openclaw.json and ~/.openclaw/agents/kids-study/openclaw.json to obtain SENSE_API_KEY and write audio files into a workspace audio directory; these behaviors are reasonable for this skill but are not declared in the registry metadata and the hard-coded agent path is surprising and should be verified.
- Install Mechanism
- noteNo install spec is provided and the included setup.sh performs only pip install requests and checks players—this is low risk. However package.json lists 'requests' and 'edge-tts' under Node-style dependencies (a mismatch: package.json is a Node manifest but references Python packages), which is incoherent and could confuse automated installers or reviewers.
- Credentials
- concernThe skill needs a SENSE_API_KEY for SenseAudio (accessed via environment variable or openclaw.json), which is appropriate for the service used. But required env vars are not declared in the skill registry metadata; additionally the scripts attempt to read agent-specific config (~/.openclaw/agents/kids-study/openclaw.json) — reading another agent's config path could expose other stored data depending on how openclaw.json is used. The skill does not request unrelated secrets, but the undeclared secret access and hard-coded path are concerning.
- Persistence & Privilege
- okThe skill is not always-enabled and has no special platform privileges. It writes audio files into a workspace audio/ date directory and does not modify other skills or global agent configuration. No 'always: true' or other elevated persistence is requested.