Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Alicloud Ai Audio Tts

Generate human-like speech audio with Model Studio DashScope Qwen TTS models (qwen3-tts-flash, qwen3-tts-instruct-flash). Use when converting text to speech,...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 967 · 2 current installs · 2 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description match the included code and docs: the skill calls DashScope Qwen TTS models. However the registry metadata lists no required credentials while both SKILL.md and scripts/generate_tts.py require a DASHSCOPE_API_KEY (or dashscope_api_key in ~/.alibabacloud/credentials). The missing declared env var is an inconsistency.
Instruction Scope
SKILL.md stays within TTS scope and gives concrete instructions (venv, pip install dashscope, set DASHSCOPE_API_KEY). The runtime script explicitly loads .env files (current dir and repo root) and ~/.alibabacloud/credentials; this is expected to locate an API key but does mean the skill will read local config files and .env files if present (which could contain unrelated secrets).
Install Mechanism
There is no install spec; the README recommends pip install dashscope in a venv. Requiring a third‑party PyPI package is reasonable for a Python SDK wrapper, but users should verify the dashscope package source/version before installing.
!
Credentials
The code and docs require a single API key (DASHSCOPE_API_KEY / dashscope_api_key), which is proportionate for a cloud TTS client. The concern is that the skill registry did not declare this required credential, so automated permission/consent tooling may not surface that a credential is needed or used.
Persistence & Privilege
always:false and no special OS restrictions. The skill does not request persistent platform privileges. It will run network calls to DashScope endpoints when invoked (normal for this purpose).
What to consider before installing
This skill appears to be a straightforward wrapper for Alibaba DashScope Qwen TTS, but take these precautions before installing: 1) Expect to provide DASHSCOPE_API_KEY (the registry metadata omitted this); verify you are comfortable supplying that API key and that it has limited scope/rotation. 2) The script will read .env files (current dir and repo root) and ~/.alibabacloud/credentials to find keys — avoid running it in projects containing unrelated secrets. 3) The skill requires pip installing the dashscope package; confirm the package and its source/version are acceptable. 4) Confirm network calls go to the official endpoints (dashscope.aliyuncs.com / dashscope-intl.aliyuncs.com) and not an unexpected host. If you need higher assurance, request the publisher to update the registry metadata to declare DASHSCOPE_API_KEY as a required credential and to document exact dashscope package versions to install.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.4
Download zip
latestvk97by2kkwcsgdjnvf9rcn49jf182pbz2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Category: provider

Model Studio Qwen TTS

Validation

mkdir -p output/alicloud-ai-audio-tts
python -m py_compile skills/ai/audio/alicloud-ai-audio-tts/scripts/generate_tts.py && echo "py_compile_ok" > output/alicloud-ai-audio-tts/validate.txt

Pass criteria: command exits 0 and output/alicloud-ai-audio-tts/validate.txt is generated.

Output And Evidence

  • Save generated audio links, sample audio files, and request payloads to output/alicloud-ai-audio-tts/.
  • Keep one validation log per execution.

Critical model names

Use one of the recommended models:

  • qwen3-tts-flash
  • qwen3-tts-instruct-flash
  • qwen3-tts-instruct-flash-2026-01-26

Prerequisites

  • Install SDK (recommended in a venv to avoid PEP 668 limits):
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope
  • Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials (env takes precedence).

Normalized interface (tts.generate)

Request

  • text (string, required)
  • voice (string, required)
  • language_type (string, optional; default Auto)
  • instruction (string, optional; recommended for instruct models)
  • stream (bool, optional; default false)

Response

  • audio_url (string, when stream=false)
  • audio_base64_pcm (string, when stream=true)
  • sample_rate (int, 24000)
  • format (string, wav or pcm depending on mode)

Quick start (Python + DashScope SDK)

import os
import dashscope

# Prefer env var for auth: export DASHSCOPE_API_KEY=...
# Or use ~/.alibabacloud/credentials with dashscope_api_key under [default].
# Beijing region; for Singapore use: https://dashscope-intl.aliyuncs.com/api/v1
dashscope.base_http_api_url = "https://dashscope.aliyuncs.com/api/v1"

text = "Hello, this is a short voice line."
response = dashscope.MultiModalConversation.call(
    model="qwen3-tts-instruct-flash",
    api_key=os.getenv("DASHSCOPE_API_KEY"),
    text=text,
    voice="Cherry",
    language_type="English",
    instruction="Warm and calm tone, slightly slower pace.",
    stream=False,
)

audio_url = response.output.audio.url
print(audio_url)

Streaming notes

  • stream=True returns Base64-encoded PCM chunks at 24kHz.
  • Decode chunks and play or concatenate to a pcm buffer.
  • The response contains finish_reason == "stop" when the stream ends.

Operational guidance

  • Keep requests concise; split long text into multiple calls if you hit size or timeout errors.
  • Use language_type consistent with the text to improve pronunciation.
  • Use instruction only when you need explicit style/tone control.
  • Cache by (text, voice, language_type) to avoid repeat costs.

Output location

  • Default output: output/alicloud-ai-audio-tts/audio/
  • Override base dir with OUTPUT_DIR.

Workflow

  1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
  2. Run one minimal read-only query first to verify connectivity and permissions.
  3. Execute the target operation with explicit parameters and bounded scope.
  4. Verify results and save output/evidence files.

References

  • references/api_reference.md for parameter mapping and streaming example.

  • Realtime mode is provided by skills/ai/audio/alicloud-ai-audio-tts-realtime/.

  • Voice cloning/design are provided by skills/ai/audio/alicloud-ai-audio-tts-voice-clone/ and skills/ai/audio/alicloud-ai-audio-tts-voice-design/.

  • Source list: references/sources.md

Files

5 total
Select a file
Select a file to preview.

Comments

Loading comments…