openai-tts-python

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: openai-tts-python Version: 1.0.1 The skill bundle is designed for text-to-speech conversion using OpenAI's API. All files (code and documentation) consistently align with this stated purpose. The `openai_tts.py` script securely retrieves the `OPENAI_API_KEY` from environment variables, which is standard practice for API authentication, and handles file operations (reading input, writing output, temporary files for audio chunking) appropriately. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts in `SKILL.md` or `README.md` that would lead to unauthorized actions or compromise the agent.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Using this skill consumes the user's OpenAI API account quota or billing balance.

Why it was flagged

The skill requires an OpenAI API key, which grants access to the user's OpenAI account and may incur usage charges. This is expected for an OpenAI TTS integration and is also disclosed in SKILL.md/README, but registry-level requirements listed no required env vars.

Skill content

api_key = os.getenv('OPENAI_API_KEY')
if not api_key:
    print("Error: OPENAI_API_KEY environment variable not set")

Recommendation

Use a scoped OpenAI key where possible, monitor usage, and install only if you are comfortable granting the skill access to your OpenAI TTS account.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any text you ask the skill to speak may be transmitted to OpenAI for processing.

Why it was flagged

The text being converted is sent to OpenAI's external TTS API. This is central to the skill's purpose and disclosed, but it means user-provided content leaves the local environment.

Skill content

response = client.audio.speech.create(
    model=model,
    voice=voice,
    input=chunks[0],
    response_format=response_format,
    speed=speed
)

Recommendation

Avoid sending secrets or sensitive private documents unless your OpenAI account and data-use settings are appropriate for that content.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Dependency versions may vary across installations, and system-package installation may require elevated privileges.

Why it was flagged

The skill relies on manually installed, unpinned third-party packages and system tools. This is common and purpose-aligned for audio generation, but users should install dependencies from trusted package sources.

Skill content

pip install openai pydub

# macOS
brew install ffmpeg

# Ubuntu/Debian
sudo apt install ffmpeg

Recommendation

Install dependencies from trusted repositories and consider pinning package versions in your own environment if reproducibility matters.