v1.0.0

tencent-tts-podcast

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:49 AM.

Analysis

The skill appears to do what it advertises—convert text to Tencent Cloud TTS audio—but users should notice that it uses Tencent cloud credentials, sends text to Tencent, and has optional cloud upload/dependency install steps.

GuidanceThis skill is coherent for Tencent Cloud TTS generation. Before installing, use scoped Tencent credentials, avoid submitting sensitive text unless cloud processing is acceptable, keep COS upload disabled unless you control the destination bucket, and install dependencies in an isolated environment.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

`upload_cos` | Whether to upload to COS, true/false (default false, local only) ... `bucket_name` | COS Bucket name (default: ti-aoi)

The skill supports uploading generated audio to Tencent COS when enabled, with documented defaults.

User impactIf COS upload is enabled, generated audio may be stored in a cloud bucket rather than remaining local.

RecommendationLeave COS upload disabled unless needed, and if enabling it, explicitly set a bucket, region, and permissions you control.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

requirements.txt

tencentcloud-sdk-python>=3.0.0
cos-python-sdk-v5>=1.8.0
requests>=2.20.0

The required packages are purpose-aligned, but they are specified with lower bounds instead of exact pinned versions.

User impactInstalling later dependency versions could change runtime behavior or introduce dependency-level issues.

RecommendationInstall in an isolated environment and consider pinning reviewed dependency versions before production use.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

tts_tool.py

return (os.environ.get("TENCENT_TTS_SECRET_ID", ""), os.environ.get("TENCENT_TTS_SECRET_KEY", ""))

The tool can use Tencent cloud credentials from the local environment or config to make TTS requests.

User impactIf broad Tencent Cloud keys are provided, the skill can use those credentials for TTS generation and potentially incur service usage costs.

RecommendationUse a Tencent CAM key scoped only to the required TTS/COS permissions, avoid using root or broad account keys, and rotate keys if they were exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

tts_podcast.py

endpoint = "https://tts.tencentcloudapi.com" ... payload = json.dumps({"Text": text, "SessionId": str(uuid.uuid4()), "VoiceType": voice_type})

The user-provided text is included in a request to Tencent Cloud's TTS API, which is expected for this skill but means text leaves the local environment.

User impactAny text converted to speech may be processed by Tencent Cloud, so private or sensitive content is shared with that provider.

RecommendationDo not submit sensitive text unless Tencent Cloud processing is acceptable for your use case and account policy.