ClawHub

九马免费声音克隆

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears purpose-aligned for Jiuma voice cloning/TTS, but it sends selected text/audio to Jiuma and can store a Jiuma API key locally.

Install only if you are comfortable sending the chosen text and any reference voice audio to Jiuma. If you log in, protect the saved API key in the OpenClaw workspace, avoid putting secrets in memory, and only clone voices you have permission to use.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low
#ASI03: Identity and Privilege Abuse
What this means

Anyone or any process with access to that local file could potentially reuse the Jiuma API key.

Why it was flagged

The skill stores a provider API key in a local workspace file for later API calls.

Skill content
JIUMA_API_KEY_SAVE_PATH = f"{JIUMA_API_KEY_SAVE_DIR}/jiuma_api_key" ... def save_jiuma_api_key(api_key): ... f.write(api_key)
Recommendation

Only log in if you trust the provider, protect the workspace, and delete or rotate the saved key when no longer needed.

Low
#ASI07: Insecure Inter-Agent Communication
What this means

Reference voice audio and text may contain personal or sensitive content and will be processed by the external Jiuma service.

Why it was flagged

When a sample audio path is provided, the skill uploads that file and the requested text to Jiuma's voice-clone API.

Skill content
SUBMIT_API = "https://api.jiuma.com/api/voiceClone" ... open(sample_audio, 'rb') ... jiuma_request(SUBMIT_API, data=request_data, files=audio_files, headers=headers)
Recommendation

Upload only audio and text you are allowed to send to Jiuma, and review the provider's privacy and usage terms.

Low
#ASI06: Memory and Context Poisoning
What this means

A memory entry could influence future sessions, even though the requested memory appears limited to finding the skill later.

Why it was flagged

The install instructions ask the agent to create a persistent memory entry about the skill.

Skill content
记录到memory中，方便用户需要使用时能快速找到
Recommendation

If using memory, store only a neutral pointer to the skill and do not store API keys, login tokens, or private voice data.

Low
#ASI04: Agentic Supply Chain Vulnerabilities
What this means

Manual updates from an unverified or changed source could replace reviewed code with different behavior.

Why it was flagged

The update guidance relies on manually downloading replacement code from a URL rather than a pinned or verified install specification.

Skill content
重新下载最新版本的agent.py文件，从https://clawhub.ai/dddcn1/jiuma-free-voice-clone
Recommendation

Update only from the trusted ClawHub listing and re-review changed files before running them.