Giggle Generation Speech

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears aligned with text-to-speech generation, but users should notice that it uses a Giggle API key, sends text to Giggle.pro, and creates local/background task state while polling.

Before installing, make sure you are comfortable sending the text you want spoken to Giggle.pro, using a GIGGLE_API_KEY from your environment, and allowing temporary polling plus local task logs under ~/.openclaw/skills/giggle-generation-speech/logs/.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can submit and query speech-generation jobs using the configured Giggle API key.

Why it was flagged

The skill requires a Giggle API key and uses it for the TTS service; this is purpose-aligned but gives the skill delegated access to the user's Giggle account/API quota.

Skill content
requires:\n  bins: [python3]\n  env: [GIGGLE_API_KEY]
Recommendation

Use a dedicated, revocable API key if possible and avoid installing if you do not want this skill to access your Giggle account.

What this means

The agent may continue polling for the audio result and send the result automatically after the original command finishes.

Why it was flagged

The skill registers a background polling job after a user starts speech generation. The behavior is disclosed and tied to task completion, but users should be aware it continues after initial submission.

Skill content
Register Cron (30s interval) – Async polling when user initiates speech generation; removed when complete
Recommendation

Confirm that background polling is acceptable for your workflow and remove the cron job if a task is no longer needed.

What this means

Text you convert to speech may be retained in local skill files, which matters if the text is private or confidential.

Why it was flagged

The helper code includes local persistence of task prompt text under the skill log directory. This supports task status messages, but text submitted for speech may remain locally after completion.

Skill content
(_get_log_dir() / f"{task_id}.prompt").write_text(text, encoding='utf-8')
Recommendation

Do not submit highly sensitive text unless you are comfortable with local retention and third-party processing; periodically clear the skill's log directory if needed.

What this means

Dependency behavior can vary over time depending on which requests version is installed.

Why it was flagged

The dependency is declared with a lower-bound version rather than an exact pinned version. This is common and purpose-aligned, but future installs may resolve to different package versions.

Skill content
requests>=2.31.0
Recommendation

Install in a managed environment and pin dependencies if you need reproducible builds.