voice-output

• Analyzed: Apr 24, 2026, 11:51 AM
• Findings: 1
• Version: 1.0.1
• Hash: 561bd1f610f4ee48b313ebcf20d65f5fae365b04c7141bb2f845262812955866
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides text-to-speech functionality by integrating with the Doubao (ByteDance) TTS API and using the macOS 'afplay' utility for audio playback. The implementation in 'voice_speak.py' is functionally sound, employing a PID-based lock file to prevent overlapping audio and safely handling subprocess calls without shell execution. While the bundle contains hardcoded API credentials (APPID and ACCESS_TOKEN) and a user-specific directory path in 'SKILL.md', these appear to be artifacts of a local development environment rather than intentional vulnerabilities or malicious features. The data flow is restricted to the stated purpose of converting text to audio via a legitimate third-party service.