Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Smart Speak Multilingual TTS (Jaskies)

v1.0.0

Chuyển đổi văn bản đa ngôn ngữ (Việt - Hoa - Anh) thành giọng nói chuẩn xác. Tự động xử lý Pinyin và ghép nối âm thanh chất lượng cao. Yêu cầu cài đặt edge-t...

0· 230·0 current·0 all-time
byTrần Anh Vũ@jaskies
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
SKILL.md advertises automatic Pinyin→Hán tự conversion and automatic language segmentation, but the provided script simply takes pre-segmented JSON and invokes edge-tts for each segment. The registry metadata also lists no required binaries while the README explicitly requires edge-tts and ffmpeg — a mismatch between declared requirements and described/actual needs.
!
Instruction Scope
Runtime instructions ask the user to install edge-tts and ffmpeg and to run the script with a segments JSON; however the doc implies the skill will perform segmentation and Pinyin conversion itself. In reality the script expects the caller to supply segments and text already converted. The script also hardcodes an absolute path to an edge-tts binary (/home/jackie_chen_phong/.local/bin/edge-tts), which is workspace/user-specific and not documented in SKILL.md as a requirement.
Install Mechanism
No install spec is provided (instruction-only), and the package includes only a small Python script. There are no downloads, no archives to extract, and nothing in the manifest that would write arbitrary code to disk beyond the included script — this is low installation risk.
Credentials
The skill requests no environment variables or credentials, which is proportional. However, the script's hardcoded absolute binary path and the sample output path reference a specific home directory (jackie_chen_phong), which leaks a username and will likely break on other systems; the manifest should have declared edge-tts and ffmpeg as required binaries.
Persistence & Privilege
The skill does not request persistent or elevated privileges and does not set always:true. It does run local binaries (edge-tts, ffmpeg) when invoked, which is expected for a TTS tool.
What to consider before installing
Things to consider before installing or using this skill: - Feature mismatch: SKILL.md promises automatic Pinyin conversion and auto-segmentation, but the included script does not implement either. You must supply pre-segmented JSON and already-converted text; do not assume the skill will transcribe/convert Pinyin for you. - Hardcoded paths: The script calls edge-tts at /home/jackie_chen_phong/.local/bin/edge-tts. That path is user-specific and likely incorrect on your machine. Edit the script to call edge-tts from PATH (e.g., just 'edge-tts') or update the path to your installation. The sample output path also references the same username — replace with your own path. - Confirm binaries and sources: The skill relies on edge-tts (Python package/CLI) and ffmpeg. Install them from trusted sources (official apt repos, pip from PyPI) and verify the edge-tts CLI is the one you expect. Because the script invokes local executables, a compromised or replaced binary on your system could run arbitrary code. - Input handling: The script uses subprocess.run with argument lists (not a shell string), which reduces command-injection risk, but it will execute whatever 'edge-tts' and 'ffmpeg' do with your text. Avoid feeding untrusted, attacker-controlled segments into the script without review. - If you need the advertised automatic Pinyin handling or language detection, request or implement that functionality (preprocessing step or a revised script). If the author provides an updated script or documentation that demonstrates those features, reassess. If you want, I can (a) suggest a safe one-line change to the script to use the edge-tts binary on PATH, (b) scan the repo for other missing features, or (c help implement the promised Pinyin-to-Hanzi step.

Like a lobster shell, security has layers — review code before you run it.

latestvk979b2mx20kc8tc86pczxma1g582rtgq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments