🗣️ Text-to-speech using GLM-TTS for generating audio

Text-to-speech conversion using GLM-TTS service via the `uvx zai-tts` command for generating audio from text. Use when (1) User requests audio/voice output w...

Security Scan

The skill's requirements and runtime instructions are consistent with a CLI-based text-to-speech integration that needs the uvx binary and an auth token for audio.z.ai, but it asks you to extract a session token from your browser localStorage which is sensitive and worth caution.

Purpose & Capability

Name/description (GLM-TTS via uvx) match the declared requirements: uvx binary and ZAI_AUDIO_USERID / ZAI_AUDIO_TOKEN environment variables are exactly what a CLI client to audio.z.ai would need.

Instruction Scope

SKILL.md only instructs running the uvx CLI with arguments and how to obtain credentials. It explicitly tells users to extract auth info from browser localStorage (JSON.parse(localStorage['auth-storage']).state.token), which is sensitive but directly related to authenticating to audio.z.ai; the instructions do not attempt to read other system files or unrelated credentials.

Install Mechanism

Install spec uses common package managers (brew or pip) for a package named 'uv' that provides uvx. Having both brew and pip installers is redundant but not inherently risky; no arbitrary download URLs or extracted archives are present.

Credentials

Only two env vars (userId and token) are required, and the token is the primary credential — appropriate for a remote TTS service. However the recommended method to obtain them (copying a session token from localStorage) can encourage insecure handling of session tokens and may expose long-lived credentials if not managed carefully.

Persistence & Privilege

Skill does not request always:true, does not declare config paths, and does not modify other skills; autonomous invocation is default but not excessive for this type of integration.

Assessment

This skill is coherent for using audio.z.ai via the uvx CLI, but be careful with the auth token. The SKILL.md asks you to copy a token from browser localStorage — treat that token like a password: don't paste it into public places, prefer creating a scoped API key if the service provides one, and store it in a secure credential store rather than a plain environment file if possible. Before installing, verify the source of the 'uv' package (brew/pypi) to ensure you're installing the intended uvx client. If you are uncomfortable extracting session tokens from your browser, contact the service to get an official API token or use an alternative TTS provider with clearer API key support.

Zai-TTS

Generate high-quality text-to-speech audio using GLM-TTS service via the uvx zai-tts command. Before using this skill, you need to configure the environment variables ZAI_AUDIO_USERID and ZAI_AUDIO_TOKEN, which can be obtained by login audio.z.ai and executing localStorage['auth-storage'] in the console via F12 Developer Tools.

Usage

uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav
uvx zai-tts -f path/to/file.txt -o {tempdir}/{filename}.wav

Changing speed, volume

uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav --speed 1.5
uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav --speed 1.5 --volume 2

Changing the voice

uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav --voice system_002

Available voices

system_001: Lila. A cheerful, standard-pronunciation female voice system_002: Chloe. A gentle, elegant, intelligent female voice system_003: Ethan. A sunny, standard-pronunciation male voice

Retrieve all available voices using shell commands:

uvx zai-tts -l

If you want to use custom voices, please complete voice cloning on the website audio.z.ai first.