Aliyun Qwen Tts Voice Clone

Use when cloning voices with Alibaba Cloud Model Studio Qwen TTS VC models. Use when creating cloned voices from sample audio and synthesizing text with clon...

Security Scan

The skill appears to implement what it says (Alibaba Qwen TTS voice cloning) and contains only a small helper script, but there are metadata/instruction mismatches and an unvetted third‑party package instruction that warrant caution.

Purpose & Capability

Name, description, included script, and SKILL.md are consistent with an Alibaba Cloud Qwen TTS voice‑cloning helper. However the skill metadata declares no required environment variables while the runtime instructions explicitly require DASHSCOPE_API_KEY (or adding dashscope_api_key to ~/.alibabacloud/credentials). That mismatch is likely an oversight but should be corrected.

Instruction Scope

SKILL.md stays within the scope of voice cloning: it explains model names, input shape, how to prepare a request JSON, recommends a venv, and where to write outputs. It does instruct persisting voice_id and storing evidence under an output directory (expected). It does not instruct reading unrelated files or exfiltrating data. The helper script only writes request JSON and validates response shape; it does not itself perform network calls or leak secrets.

Install Mechanism

There is no formal install spec in the registry (instruction-only), but the README tells users to pip install 'dashscope' into a venv. Installing a third‑party package from PyPI (or elsewhere) has moderate risk — the origin/maintainer of 'dashscope' is not documented here and should be verified before installation.

Credentials

The SKILL.md requires DASHSCOPE_API_KEY or an entry in ~/.alibabacloud/credentials, which is proportional for accessing Alibaba Cloud APIs. However the registry metadata lists no required env vars or primary credential; that inconsistency reduces transparency. Users should be aware this skill expects cloud API credentials and should scope them tightly.

Persistence & Privilege

The skill is not forced-always, does not request system-wide changes, and contains no install script that writes into system locations. It writes artifacts to an output/ directory (documented). Autonomous invocation remains enabled by default but is not combined here with other broad privileges.

What to consider before installing

This skill mostly appears to do what it says (prepare requests and validate responses for Alibaba Qwen TTS voice cloning) and the included script is small and readable. Before installing or running it: 1) Verify the 'dashscope' package source and integrity (PyPI page, project repo, maintainer) before pip installing; prefer installing in an isolated venv or container. 2) Only provide a DASHSCOPE_API_KEY (or Alibaba credentials) with the minimum permissions needed for voice cloning; avoid using long‑lived or broadly privileged keys. 3) Ensure you have explicit consent to clone any voice samples you upload or reference. 4) Ask the skill author to update the registry metadata to list required environment variables (DASHSCOPE_API_KEY) so the credential requirement is transparent. 5) Review any real network calls (not present in the helper script) that your agent will make at runtime and audit where outputs/evidence files are written. These steps will mitigate the primary risks (unvetted dependency and undisclosed credential requirement).

Category: provider

Model Studio Qwen TTS Voice Clone

Use voice cloning models to replicate timbre from enrollment audio samples.

Critical model names

Use one of these exact model strings:

• qwen3-tts-vc-2026-01-22
• qwen3-tts-vc-realtime-2026-01-15

Prerequisites

• Install SDK in a virtual environment:

python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

• Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.

Normalized interface (tts.voice_clone)

Request

• text (string, required)
• voice_sample (string | bytes, required) enrollment sample
• voice_name (string, optional)
• stream (bool, optional)

Response

• audio_url (string) or streaming PCM chunks
• voice_id (string)
• request_id (string)

Operational guidance

• Use clean speech samples with low background noise.
• Respect consent and policy requirements for cloned voices.
• Persist generated voice_id and reuse for future synthesis requests.

Local helper script

Prepare a normalized request JSON and validate response schema:

.venv/bin/python skills/ai/audio/aliyun-qwen-tts-voice-clone/scripts/prepare_voice_clone_request.py \
  --text "Welcome to this voice-clone demo" \
  --voice-sample "https://example.com/voice-sample.wav"

Output location

• Default output: output/ai-audio-tts-voice-clone/audio/
• Override base dir with OUTPUT_DIR.

Validation

mkdir -p output/aliyun-qwen-tts-voice-clone
for f in skills/ai/audio/aliyun-qwen-tts-voice-clone/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/aliyun-qwen-tts-voice-clone/validate.txt

Pass criteria: command exits 0 and output/aliyun-qwen-tts-voice-clone/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/aliyun-qwen-tts-voice-clone/.
• Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Workflow

1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
2. Run one minimal read-only query first to verify connectivity and permissions.
3. Execute the target operation with explicit parameters and bounded scope.
4. Verify results and save output/evidence files.

References

• references/sources.md