Alicloud Ai Audio Cosyvoice Voice Design

Use when designing custom voices with Alibaba Cloud Model Studio CosyVoice customization models, especially cosyvoice-v3.5-plus or cosyvoice-v3.5-flash, from...

Security Scan

The skill generally matches its stated purpose (preparing CosyVoice enrollment requests), but there are inconsistencies around required credentials and a local helper that can read arbitrary files which merit caution before installing or running it.

Purpose & Capability

The skill's name, description, endpoints, and helper script all match an Alibaba Cloud CosyVoice voice-design workflow — requesting an API key and calling dashscope endpoints is expected. However, the registry metadata declares no required environment variables or primary credential while SKILL.md explicitly instructs the user to set DASHSCOPE_API_KEY or add a credential to ~/.alibabacloud/credentials. That metadata/instruction mismatch is incoherent and should be corrected.

Instruction Scope

Runtime instructions are focused: prepare a JSON request, optionally validate a response, and save artifacts under an output directory. The SKILL.md references only the CosyVoice endpoints and local paths; it does not instruct the agent to exfiltrate data to third-party endpoints. It does request storing 'evidence' including voice_prompt and preview_text, which may contain user-provided content and should be treated as potentially sensitive.

Install Mechanism

This is an instruction-only skill with one small helper script; there is no install spec and nothing is downloaded or installed. That lowers risk.

Credentials

The SKILL.md requires DASHSCOPE_API_KEY or credentials in ~/.alibabacloud/credentials but the skill registry lists no required env vars or primary credential — a mismatch. The helper script also accepts --validate-response which reads an arbitrary local JSON path; if misused it could cause local file disclosure when run by an agent. Requesting a single service API key is proportionate for this purpose, but the registry should declare it and users should provide a scoped (least-privilege) key.

Persistence & Privilege

The skill does not request always:true and is user-invocable; it does not request persistent or elevated platform privileges and does not modify other skills' configs.

What to consider before installing

This skill appears to do what it says (build CosyVoice enrollment requests) but there are a few concerns to address before using it: - The SKILL.md tells you to set DASHSCOPE_API_KEY or add dashscope credentials, but the registry metadata lists no required credentials — treat that as an omission, not a guarantee of safety. Provide a scoped, rotation-ready API key with minimal privileges. - Review the helper script before running. Its --validate-response option reads any local JSON file path you pass: do not point it at sensitive system files. If you run the skill under an agent, confirm the agent will not call the script with attacker-controlled file paths. - Verify the endpoints in SKILL.md (dashscope.aliyuncs.com and dashscope-intl.aliyuncs.com) match official Alibaba Cloud documentation for your region. - Because the skill writes 'evidence' containing your voice_prompt and preview_text to an output directory, avoid including secrets or sensitive PII in those fields. - Consider asking the publisher to update registry metadata to declare DASHSCOPE_API_KEY as a required credential and to document any data storage/retention expectations. If you cannot verify the publisher, run the script locally in an isolated environment and with a least-privilege API key.

Category: provider

Model Studio CosyVoice Voice Design

Use the CosyVoice voice enrollment API to create designed voices from a natural-language voice description.

Critical model names

Use model="voice-enrollment" and one of these target_model values:

• cosyvoice-v3.5-plus
• cosyvoice-v3.5-flash
• cosyvoice-v3-plus
• cosyvoice-v3-flash

Recommended default in this repo:

• target_model="cosyvoice-v3.5-plus"

Region and compatibility

• cosyvoice-v3.5-plus and cosyvoice-v3.5-flash are available only in China mainland deployment mode (Beijing endpoint).
• In international deployment mode (Singapore endpoint), cosyvoice-v3-plus and cosyvoice-v3-flash do not support voice clone/design.
• The target_model must match the later speech synthesis model.

Endpoint

• Domestic: https://dashscope.aliyuncs.com/api/v1/services/audio/tts/customization
• International: https://dashscope-intl.aliyuncs.com/api/v1/services/audio/tts/customization

Prerequisites

• Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.

Normalized interface (cosyvoice.voice_design)

Request

• model (string, optional): fixed to voice-enrollment
• target_model (string, optional): default cosyvoice-v3.5-plus
• prefix (string, required): letters/digits only, max 10 chars
• voice_prompt (string, required): max 500 chars, Chinese or English only
• preview_text (string, required): max 200 chars, Chinese or English
• language_hints (array[string], optional): zh or en, and should match preview_text
• sample_rate (int, optional): e.g. 24000
• response_format (string, optional): e.g. wav

Response

• voice_id (string)
• request_id (string)
• status (string, optional)

Operational guidance

• Keep voice_prompt concrete: timbre, age range, pace, emotion, articulation, and scenario.
• If language_hints is used, it should match the language of preview_text.
• Designed voice names include a -vd- marker in the generated backend naming convention.

Local helper script

Prepare a normalized request JSON:

python skills/ai/audio/alicloud-ai-audio-cosyvoice-voice-design/scripts/prepare_cosyvoice_design_request.py \
  --target-model cosyvoice-v3.5-plus \
  --prefix announcer \
  --voice-prompt "沉稳的中年男性播音员，低沉有磁性，语速平稳，吐字清晰。" \
  --preview-text "各位听众朋友，大家好，欢迎收听晚间新闻。" \
  --language-hint zh

Validation

mkdir -p output/alicloud-ai-audio-cosyvoice-voice-design
for f in skills/ai/audio/alicloud-ai-audio-cosyvoice-voice-design/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/alicloud-ai-audio-cosyvoice-voice-design/validate.txt

Pass criteria: command exits 0 and output/alicloud-ai-audio-cosyvoice-voice-design/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/alicloud-ai-audio-cosyvoice-voice-design/.
• Include target_model, prefix, voice_prompt, and preview_text in the evidence file.

References

• references/api_reference.md
• references/sources.md