ClawHub

iFLYTEK Song Recognition

v1.0.0

Recognize songs by singing or audio file using iFlytek's Query By ACRCloud technology.

⭐ 0· 234·0 current·0 all-time
by@dzy-1026
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (song recognition) match the code and required env vars (XF_SONG_APP_ID, XF_SONG_API_KEY, XF_SONG_API_SECRET). The script implements audio file base64 encoding and posts to an xfyun API endpoint — expected for this purpose. Minor mismatch: SKILL.md mentions 'Query By ACRCloud technology' while the code calls xfyun endpoints; this appears to be a documentation inaccuracy but not malicious.
✓
Instruction Scope
Runtime instructions and the Python script only read the provided audio file and environment variables, build an authenticated request, and send the audio to the stated API endpoint. There are no instructions to read unrelated files, scan system state, or exfiltrate data to unexpected endpoints.
✓
Install Mechanism
No install spec; the skill is instruction-only with an included Python script and requires python3 on PATH. No remote downloads or archive extraction are performed by an installer.
✓
Credentials
The three required env vars are API credentials for the remote service the skill integrates with and are proportionate to the stated functionality. The script only uses those env vars and no other secrets or unrelated configuration paths.
✓
Persistence & Privilege
The skill is not forced-always; it does not modify other skills or system-wide settings and requests no persistent elevated privileges.
Assessment
This skill will send the provided audio file and your XF_SONG_* credentials to xfyun's API endpoint. Only install if you trust that service and are comfortable with audio and associated metadata being transmitted. Verify you supply minimal/limited credentials (rotate keys if possible), and avoid putting long-lived/privileged secrets into global envs used by other tools. Note the SKILL.md text mentions ACRCloud but the code calls xfyun — a documentation mismatch worth confirming with the publisher if you need provenance or compliance guarantees.

Like a lobster shell, security has layers — review code before you run it.

latestvk978qkzbwc4zsqmr9dwpchf36d82d1p7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎵 Clawdis
Binspython3
EnvXF_SONG_APP_ID, XF_SONG_API_KEY, XF_SONG_API_SECRET
Primary envXF_SONG_APP_ID

Comments