smart-tts

• Analyzed: May 11, 2026, 7:19 AM
• Findings: 0
• Version: 1.0.3
• Hash: b9cc243d17bf62a005cc0048279e55ab9358473d280e435d4dfb4c608486e25b
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: smart-tts Version: 1.0.3 The 'smart-tts' skill is a legitimate utility for text-to-speech synthesis using the Alibaba DashScope API. It implements a retry mechanism to handle specific API errors (e.g., HTTP 418) by iterating through different model and voice combinations. The code (scripts/generate.py and scripts/batch.py) follows standard practices for API usage, such as reading credentials from environment variables and writing output to a designated workspace directory, with no evidence of malicious behavior or prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

The skill can use the configured DashScope account and may consume quota or incur provider usage costs.

Why it was flagged

The script reads a DashScope API key from the environment and uses it for provider calls. This is expected for the TTS service, but the registry metadata does not declare a required credential.

Skill content

API_KEY = os.environ.get("DASHSCOPE_API_KEY", "") ... dashscope.api_key = API_KEY

Recommendation

Use a limited-purpose DashScope key, store it securely, and monitor provider usage.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Any text given to the skill, including batch text, may be sent to the external TTS provider.

Why it was flagged

The supplied text is passed to the DashScope speech synthesizer. This is necessary for cloud TTS, but it means the text leaves the local environment.

Skill content

result = synthesizer.call(text)

Recommendation

Avoid sending confidential or regulated text unless the DashScope account and data handling terms are acceptable.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Users may need to install or rely on a local DashScope package that is not pinned or described by the skill metadata.

Why it was flagged

The code depends on the third-party DashScope SDK, while the provided install metadata has no install spec or declared dependency.

Skill content

import dashscope
from dashscope.audio.tts_v2 import SpeechSynthesizer

Recommendation

Install the DashScope SDK only from a trusted package source and prefer pinned, reviewed versions.