Security audit
Security checks across malware telemetry and agentic risk
This voice-cloning skill sends sensitive prompts and media to a configurable remote API, but its scope and privacy boundaries are not clearly disclosed.
Review this before installing. Only use it if you understand which remote service TEAM_BASE_URL points to, trust that endpoint, and are comfortable sending prompts and media there with your bearer token. Do not submit someone else's voice sample unless you have permission, and avoid sensitive or private media until the skill adds clear privacy, consent, endpoint validation, and input-scope controls.
print(f"Invoking model: {args.model} ...")
try:
response = requests.post(endpoint, headers=headers, json=payload)
response.raise_for_status()
result = response.json()while True:
time.sleep(3) # 每3秒查询一次
poll_resp = requests.get(poll_endpoint, headers=headers)
poll_resp.raise_for_status()
poll_data = poll_resp.json()64/64 vendors flagged this skill as clean.