ifly-hyper-tts
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to be a straightforward text-to-speech integration that uses iFlytek credentials and sends user-provided text to iFlytek to generate an audio file.
This skill looks coherent for text-to-speech use. Before installing, make sure you are comfortable providing iFlytek API credentials, sending the text you synthesize to iFlytek, and installing the websocket-client Python dependency from a trusted source.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill may consume the user's iFlytek API quota or billing entitlement.
The skill requires iFlytek application credentials to authenticate to the TTS service. This is expected for the stated integration, but it gives the skill access to the user's iFlytek API quota/account context.
"env": ["XFEI_APP_ID", "XFEI_API_KEY", "XFEI_API_SECRET"]
Use a dedicated iFlytek API key with only the permissions needed for TTS, and rotate it if the skill is no longer used.
Any text converted to speech may be processed by the external TTS provider.
The code connects to an external iFlytek WebSocket endpoint to perform speech synthesis. This is purpose-aligned, but it means submitted text is sent to the provider.
WS_URL = "wss://cbm01.cn-huabei-1.xf-yun.com/v1/private/mcd9m97e6"
Avoid sending sensitive, confidential, or regulated text unless the iFlytek account and data handling terms are acceptable.
Dependency installation introduces normal package supply-chain risk.
The README instructs installing an unpinned Python dependency that is not represented by a formal install spec. This is common for a WebSocket-based Python tool, but users should install it from a trusted package index.
pip install websocket-client
Install websocket-client from a trusted source and consider pinning a reviewed version in controlled environments.