Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Alicloud Ai Audio Tts Realtime

v1.0.1

Real-time speech synthesis with Alibaba Cloud Model Studio Qwen TTS Realtime models. Use when low-latency interactive speech is required, including instructi...

0· 791·2 current·2 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for cinience/alicloud-ai-audio-tts-realtime.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Alicloud Ai Audio Tts Realtime" (cinience/alicloud-ai-audio-tts-realtime) from ClawHub.
Skill page: https://clawhub.ai/cinience/alicloud-ai-audio-tts-realtime
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install alicloud-ai-audio-tts-realtime

ClawHub CLI

Package manager switcher

npx clawhub@latest install alicloud-ai-audio-tts-realtime
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description and the included Python probe script align with realtime TTS via Alibaba Cloud's dashscope SDK and the listed Qwen models — that capability is coherent. However, the package metadata declares no required environment variables while the runtime script requires DASHSCOPE_API_KEY (or credentials file), which is an inconsistency.
!
Instruction Scope
SKILL.md gives reasonable runtime guidance, but the included script will automatically load .env files from the current working dir and the repository root and will read ~/.alibabacloud/credentials to populate DASHSCOPE_API_KEY; this behavior means the skill could pull unrelated secrets from your environment. The script also downloads audio from URLs returned by the service (audio_url) — normally expected, but it will fetch arbitrary URLs provided in responses, which enlarges the network trust surface.
Install Mechanism
No install spec (instruction-only) and only a pip dependency (dashscope) are required. There is no opaque remote download/install mechanism in the skill bundle itself.
!
Credentials
The runtime requires DASHSCOPE_API_KEY (or credentials entry) though the registry metadata lists no required env vars; this mismatch is misleading. Additionally, the script's auto-loading of .env files can expose unrelated environment secrets to the skill if present.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configs, and is user-invocable. It writes outputs to a user-visible output directory only.
What to consider before installing
This skill generally does what it says (realtime TTS using Alibaba's dashscope SDK), but take these precautions before installing: - Expect to supply DASHSCOPE_API_KEY (or add dashscope_api_key to ~/.alibabacloud/credentials). The skill metadata should have declared this but didn't — treat that as a red flag. - The bundled script will auto-load .env files from the current working directory and the repo root. If you have sensitive secrets in .env, run the probe in a clean/sandboxed environment or remove secrets first. - The script downloads audio from URLs returned by the service. Ensure you trust the dashscope endpoint (default base URL is dashscope.aliyuncs.com) and consider running in a network-restricted environment if you want to limit unexpected external fetches. - Review the script locally before running (it is short and readable). If you proceed, run in a virtualenv, set OUTPUT_DIR to an isolated path, and verify the DASHSCOPE_API_KEY scope/permissions are minimal. - If you maintain the registry entry, update the metadata to declare DASHSCOPE_API_KEY in requires.env and document the .env auto-loading behavior to remove the mismatch.

Like a lobster shell, security has layers — review code before you run it.

latestvk974370qfxaaa37cyw3ep5e2an82qptn
791downloads
0stars
2versions
Updated 6h ago
v1.0.1
MIT-0

Category: provider

Model Studio Qwen TTS Realtime

Use realtime TTS models for low-latency streaming speech output.

Critical model names

Use one of these exact model strings:

  • qwen3-tts-flash-realtime
  • qwen3-tts-instruct-flash-realtime
  • qwen3-tts-instruct-flash-realtime-2026-01-22
  • qwen3-tts-vd-realtime-2026-01-15
  • qwen3-tts-vc-realtime-2026-01-15

Prerequisites

  • Install SDK in a virtual environment:
python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope
  • Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.

Normalized interface (tts.realtime)

Request

  • text (string, required)
  • voice (string, required)
  • instruction (string, optional)
  • sample_rate (int, optional)

Response

  • audio_base64_pcm_chunks (array<string>)
  • sample_rate (int)
  • finish_reason (string)

Operational guidance

  • Use websocket or streaming endpoint for realtime mode.
  • Keep each utterance short for lower latency.
  • For instruction models, keep instruction explicit and concise.
  • Some SDK/runtime combinations may reject realtime model calls over MultiModalConversation; use the probe script below to verify compatibility.

Local demo script

Use the probe script to verify realtime compatibility in your current SDK/runtime, and optionally fallback to a non-realtime model for immediate output:

.venv/bin/python skills/ai/audio/alicloud-ai-audio-tts-realtime/scripts/realtime_tts_demo.py \
  --text "This is a realtime speech demo." \
  --fallback \
  --output output/ai-audio-tts-realtime/audio/fallback-demo.wav

Strict mode (for CI / gating):

.venv/bin/python skills/ai/audio/alicloud-ai-audio-tts-realtime/scripts/realtime_tts_demo.py \
  --text "realtime health check" \
  --strict

Output location

  • Default output: output/ai-audio-tts-realtime/audio/
  • Override base dir with OUTPUT_DIR.

Validation

mkdir -p output/alicloud-ai-audio-tts-realtime
for f in skills/ai/audio/alicloud-ai-audio-tts-realtime/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/alicloud-ai-audio-tts-realtime/validate.txt

Pass criteria: command exits 0 and output/alicloud-ai-audio-tts-realtime/validate.txt is generated.

Output And Evidence

  • Save artifacts, command outputs, and API response summaries under output/alicloud-ai-audio-tts-realtime/.
  • Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Workflow

  1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
  2. Run one minimal read-only query first to verify connectivity and permissions.
  3. Execute the target operation with explicit parameters and bounded scope.
  4. Verify results and save output/evidence files.

References

  • references/sources.md

Comments

Loading comments...