ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenClaw Turbo-Bundle: Groq, OpenRouter & Elite TTS

v1.0.1

Integrates Groq and OpenRouter models with smart free-ride optimization and elite bilingual Saudi Arabic/English TTS for high-speed, cost-free performance.

⭐ 1· 86·0 current·0 all-time
byTheGrayMan_AI@rvigoo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The skill claims Groq, OpenRouter, and a 'Free-Ride' optimizer. The included code uses the Groq SDK and expects a GROQ_API_KEY (in .env). However, the registry metadata declared no required env vars or primary credential, and OpenRouter keys are only mentioned in prose, not used by code — this mismatch between claimed requirements and declared metadata is incoherent.
!
Instruction Scope
SKILL.md (and the sub-skill SKILL.md) instructs the agent to always print an exact localhost URL to the generated audio file (http://127.0.0.1:18789/__openclaw__/canvas/speech.wav). The speech.py script writes a speech.wav into a canvas directory, but the README hardcodes a Windows user path (C:\Users\inves\.openclaw\canvas\) while the script resolves a relative path — this inconsistency and the mandatory 'you MUST paste this link' requirement are scope creep and potentially coercive (forces the agent to reveal/advertise a local resource every time).
ℹ
Install Mechanism
There is no platform install spec (instruction-only), which lowers risk. The included configure.py runs pip install -r requirements.txt and pip install free-ride. Installing an extra package ('free-ride') not listed in requirements is unusual and should be reviewed; otherwise dependencies are typical (groq, python-dotenv). configure.py executes shell commands with subprocess.run but only when the user runs the script.
!
Credentials
Metadata declares no required env vars, but code requires GROQ_API_KEY in a local .env and README/configure mention OPENROUTER_API_KEY. This mismatch (undeclared secrets) is disproportionate and misleading. The skill asks for API keys (sensitive) that are not reflected in the registry metadata.
✓
Persistence & Privilege
The skill is not always-enabled, does not request system-wide config changes, and does not modify other skills. It does write a speech.wav into a canvas directory inside the workspace (normal for a TTS skill).
What to consider before installing
This package appears to implement the advertised Groq TTS functionality, but there are several red flags you should address before installing: - Secrets mismatch: The package actually requires a GROQ_API_KEY (via a .env file) and the README mentions OPENROUTER_API_KEY, yet the registry metadata lists no required env vars. Treat API keys as sensitive; do not provide them until you verify the code and endpoints. - Forced output behavior: The skill's instructions demand the agent always paste a specific localhost URL to the generated audio file. That behavior is unusual and could be abused to make the agent repeatedly expose local resources or to standardize an endpoint for other automated actions. Consider whether you want your agent forced to emit that exact URL. - Extra pip package: configure.py installs an additional package, 'free-ride', not listed in requirements.txt. Inspect that package on PyPI (or the source) before running configure.py. - Inconsistent paths: README references a hardcoded Windows path, while speech.py writes to a relative canvas directory. Confirm where files will be written on your system and whether that location is acceptable. Recommendations: 1. Review the 'free-ride' package source or avoid running configure.py; instead manually install only known dependencies (groq, python-dotenv). 2. Inspect speech.py and configure.py yourself (they are short) and run them in an isolated environment or VM. 3. Only create the .env with GROQ_API_KEY if you trust the Groq integration and prefer the local file placement. 4. If you do not want your agent to be forced to output the localhost link, remove or edit the 'MANDATORY' instruction in the skill before using it. 5. If unsure, test in an ephemeral workspace or container and do not expose real production credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk9778wnry27q2727mqs7hgqt9n83ey2w

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments