Baidu Speech Synthesis
v1.2.3Baidu Intelligent Cloud Speech Synthesis (TTS), supporting multi-role dialogue audio generation, SSML/segment-merge dual modes, speech rate/pitch adjustment.
⭐ 0· 111·1 current·1 all-time
by@guoxh
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Baidu TTS) matches required binaries (python3, ffmpeg), required env vars (BAIDU_API_KEY, BAIDU_SECRET_KEY), and included client/formatter/merger scripts. No unrelated credentials or surprising binaries are requested.
Instruction Scope
SKILL.md and the scripts instruct the agent to read input text files, build SSML, call Baidu token and TTS endpoints, produce temporary audio files and merge them with ffmpeg. These actions are within the stated purpose. Note: some helper scripts (validate_config, diagnose_auth) perform network calls to Baidu endpoints and inspect environment variables (including BAIDU_ACCESS_TOKEN if present); this is expected behavior but worth noting.
Install Mechanism
No remote download/install spec is present (instruction-only install). Dependencies are typical Python libraries and ffmpeg. Minor inconsistency: SKILL.md suggests installing only requests, whereas requirements.txt also lists pydub and python-dotenv; this is not a security issue but is a documentation mismatch to be aware of.
Credentials
Requested environment variables (BAIDU_API_KEY as primary, BAIDU_SECRET_KEY when needed) are proportionate for a Baidu TTS client. The skill supports access_token and IAM key formats as well. One caveat: validate_config enforces specific length/alphanumeric checks for API/Secret that may not match all valid key formats (e.g., bce-v3 IAM keys), causing false failures if using alternate auth methods.
Persistence & Privilege
Skill is not force-included (always: false) and is user-invocable. It allows autonomous invocation (platform default) but does not request elevated or system-wide persistence or credentials for other skills.
Assessment
This skill appears to do what it claims: construct SSML, call Baidu TTS endpoints, and merge audio with ffmpeg. Before installing, consider: (1) Keys you provide (BAIDU_API_KEY / BAIDU_SECRET_KEY or access_token/IAM key) will be used to call Baidu endpoints — keep them secret and prefer least-privilege keys scoped to TTS. (2) validate_config may require both API and Secret for its checks and may reject some valid IAM/access-token formats; if you use an alternative auth method, the validator might give false errors. (3) The skill runs ffmpeg via subprocess and writes temporary files — avoid feeding untrusted input files to prevent maliciously crafted inputs from causing problems. (4) The included requirements.txt lists pydub and python-dotenv in addition to requests; install only what you need and review the code if you plan to run it in sensitive environments. Overall the package is internally consistent with its stated purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk975sgavhrm60jc9certrmsdgs83z7d7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔊 Clawdis
Binspython3, ffmpeg
EnvBAIDU_API_KEY, BAIDU_SECRET_KEY
Primary envBAIDU_API_KEY