openai-tts-python

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a straightforward OpenAI text-to-speech helper, with some expected notes around using an OpenAI API key, sending text to OpenAI, and manually installed dependencies.

This appears safe for its stated purpose. Before installing, make sure you are comfortable providing an OpenAI API key, sending the text you convert to OpenAI, and manually installing the listed dependencies.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Using this skill consumes the user's OpenAI API account quota or billing balance.

Why it was flagged

The skill requires an OpenAI API key, which grants access to the user's OpenAI account and may incur usage charges. This is expected for an OpenAI TTS integration and is also disclosed in SKILL.md/README, but registry-level requirements listed no required env vars.

Skill content

api_key = os.getenv('OPENAI_API_KEY')
if not api_key:
    print("Error: OPENAI_API_KEY environment variable not set")

Recommendation

Use a scoped OpenAI key where possible, monitor usage, and install only if you are comfortable granting the skill access to your OpenAI TTS account.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any text you ask the skill to speak may be transmitted to OpenAI for processing.

Why it was flagged

The text being converted is sent to OpenAI's external TTS API. This is central to the skill's purpose and disclosed, but it means user-provided content leaves the local environment.

Skill content

response = client.audio.speech.create(
    model=model,
    voice=voice,
    input=chunks[0],
    response_format=response_format,
    speed=speed
)

Recommendation

Avoid sending secrets or sensitive private documents unless your OpenAI account and data-use settings are appropriate for that content.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Dependency versions may vary across installations, and system-package installation may require elevated privileges.

Why it was flagged

The skill relies on manually installed, unpinned third-party packages and system tools. This is common and purpose-aligned for audio generation, but users should install dependencies from trusted package sources.

Skill content

pip install openai pydub

# macOS
brew install ffmpeg

# Ubuntu/Debian
sudo apt install ffmpeg

Recommendation

Install dependencies from trusted repositories and consider pinning package versions in your own environment if reproducibility matters.