Fish Audio TTS
Security checks across malware telemetry and agentic risk
Overview
The package is internally consistent with its stated purpose (an OpenClaw Fish Audio TTS provider) and only requires a Fish Audio API key; there are no unexpected credentials, downloads, or privileged behaviors.
This plugin appears to be what it claims: an OpenClaw speech provider for Fish Audio that just needs your Fish Audio API key. Before installing, consider: (1) install from a trusted registry (npm / ClawHub) and verify the package source, (2) review or run the code in a sandbox if you want to inspect runtime behavior, (3) be aware the code contains a small bug (a likely typo in the AbortController usage) that could cause runtime errors — not malicious behavior but may need a fix upstream, (4) limit the API key's scope if Fish Audio supports scoped keys and rotate the key after trusting a third-party plugin, and (5) if you prefer tighter control, only enable the plugin for specific agent sessions or environments rather than broadly in production.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings