Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to do what it claims, but it sends text and voice samples to an external speech service and supports voice cloning without clear consent and privacy safeguards.
Review before installing. Use this only for voices you own or have explicit permission to clone, avoid submitting confidential or regulated text/audio, and keep DOUBAO credentials scoped and protected. Expect data to be processed by the external Volcano Engine/ByteDance speech service and check that service's retention, billing, and acceptable-use terms before use.
body["extra_params"] = extra_params
print(f"\nSubmitting voice cloning training (language: {LANGUAGE_MAP.get(args.language, args.language)})...")
resp = requests.post(BASE_URL + CLONE_PATH, headers=headers, json=body, timeout=60)
if resp.status_code != 200:
try:# Authentication (CLI arguments take priority, then environment variables/.env)
auth = parser.add_argument_group("Authentication (choose one: new or legacy console; can also be configured via .env or environment variables)")
auth.add_argument("--api-key", default=os.environ.get("DOUBAO_API_KEY"),
help="New console API Key (recommended; can also set DOUBAO_API_KEY)")
auth.add_argument("--app-key", default=os.environ.get("DOUBAO_APP_KEY"),
help="Legacy console App Key (can also set DOUBAO_APP_KEY)")auth = parser.add_argument_group("Authentication (choose one: new or legacy console; can also be configured via .env or environment variables)")
auth.add_argument("--api-key", default=os.environ.get("DOUBAO_API_KEY"),
help="New console API Key (recommended; can also set DOUBAO_API_KEY)")
auth.add_argument("--app-key", default=os.environ.get("DOUBAO_APP_KEY"),
help="Legacy console App Key (can also set DOUBAO_APP_KEY)")
auth.add_argument("--access-key", default=os.environ.get("DOUBAO_ACCESS_KEY"),
help="Legacy console Access Key (can also set DOUBAO_ACCESS_KEY)")help="New console API Key (recommended; can also set DOUBAO_API_KEY)")
auth.add_argument("--app-key", default=os.environ.get("DOUBAO_APP_KEY"),
help="Legacy console App Key (can also set DOUBAO_APP_KEY)")
auth.add_argument("--access-key", default=os.environ.get("DOUBAO_ACCESS_KEY"),
help="Legacy console Access Key (can also set DOUBAO_ACCESS_KEY)")
# Voice ID# Authentication (CLI arguments take priority, then environment variables/.env)
auth = parser.add_argument_group("Authentication (can also be configured via .env or environment variables)")
auth.add_argument("--api-key", default=os.environ.get("DOUBAO_API_KEY"),
help="New console API Key (can also set DOUBAO_API_KEY)")
auth.add_argument("--app-id", default=os.environ.get("DOUBAO_APP_ID"),
help="Legacy console App ID (can also set DOUBAO_APP_ID)")help="New console API Key (can also set DOUBAO_API_KEY)")
auth.add_argument("--app-id", default=os.environ.get("DOUBAO_APP_ID"),
help="Legacy console App ID (can also set DOUBAO_APP_ID)")
auth.add_argument("--access-key", default=os.environ.get("DOUBAO_ACCESS_KEY"),
help="Legacy console Access Key (can also set DOUBAO_ACCESS_KEY)")
# Synthesis parametersscript_dir = os.path.dirname(os.path.abspath(__file__))
candidates = [
os.path.join(script_dir, ".env"),
os.path.join(script_dir, "..", ".env"),
]
for path in candidates:
path = os.path.normpath(path)script_dir = os.path.dirname(os.path.abspath(__file__))
candidates = [
os.path.join(script_dir, ".env"),
os.path.join(script_dir, "..", ".env"),
]
for path in candidates:
path = os.path.normpath(path)No suspicious patterns detected.