Pronunciation Coach

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill appears coherent and purpose-aligned, but it sends local voice recordings to Microsoft Azure using your Azure Speech key, so only use it with audio you intend to share.

This skill is reasonable for pronunciation coaching if you are comfortable sending the chosen voice recording to Azure. Before installing, make sure ffmpeg and Node.js are available, provide a restricted Azure Speech key via environment variables, and verify the audio file is one you intend to analyze.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Voice recordings may contain sensitive personal or biometric information and will be processed by Azure.

Why it was flagged

The skill clearly discloses that private voice recordings leave the local machine for a third-party speech provider.

Skill content

Privacy Note: This skill reads local voice messages from `~/.openclaw/media/inbound/` and transmits them to Microsoft Azure Speech Services for processing.

Recommendation

Use it only with recordings you have permission to upload, confirm the selected audio file, and review Azure Speech data handling/retention settings if privacy is important.

Low

#ASI03: Identity and Privilege Abuse

What this means

An exposed or overly broad Azure key could be misused or incur charges.

Why it was flagged

The skill uses a user-provided Azure Speech key to call the service, which is expected for the integration but is still a credential with account/billing impact.

Skill content

AZURE_KEY="${3:-$AZURE_SPEECH_KEY}" ... -H "Ocp-Apim-Subscription-Key: ${AZURE_KEY}"

Recommendation

Prefer environment variables over command-line key arguments, use a limited Azure Speech resource/key, and rotate the key if it is accidentally exposed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Install/preflight metadata may not warn users that credentials and local tools are needed.

Why it was flagged

The registry-level requirements under-declare purpose-aligned prerequisites that SKILL.md and skill.json describe, including Azure env vars, ffmpeg, and Node.js.

Skill content

Required binaries (all must exist): none ... Required env vars: none ... Primary credential: none

Recommendation

Read SKILL.md and skill.json before use, and the publisher should align registry metadata with the declared Azure credentials and tool prerequisites.