Security audit
Security checks across malware telemetry and agentic risk
This TTS skill mostly does what it advertises, but it also adds mandatory update-management behavior that can run another local skill and write persistent state outside the audio task.
Install only if you are comfortable using a QwenCloud/DashScope API key and sending synthesis text, and possibly voice samples, to that service. Review any update-check prompt before approving it, inspect the separate qwencloud-update-check skill before installing it, avoid custom `QWEN_BASE_URL` values unless you trust the endpoint, and approve agent config edits only if you want persistent QwenCloud skill registration.
if not script.is_file():
return
try:
proc = subprocess.run(
[sys.executable, str(script), "--print-response"],
capture_output=True, text=True, timeout=15,
)"""Download a file from *url* to *dest*, creating parent dirs as needed."""
dest.parent.mkdir(parents=True, exist_ok=True)
req = urllib.request.Request(url, headers={"User-Agent": "qwencloud-ai/1.0"})
with urllib.request.urlopen(req, timeout=timeout) as resp:
dest.write_bytes(resp.read())
return dest66/66 vendors flagged this skill as clean.
No suspicious patterns detected.