Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

melo-tts-metadata-creator

v1.0.6

当用户需要为 **MeloTTS** 训练或微调生成 metadata.list 文件时自动触发。 专门处理 .wav 音频文件和对应的 .txt 转录文本,自动生成符合 MeloTTS 官方最新标准的 metadata.list(格式:音频路径|speaker|语言|文本)。 支持单音色和多音色模式: - wa...

0· 245·0 current·0 all-time
by顶尖王牌程序员@wangminrui2022

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for wangminrui2022/melo-tts-metadata-creator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "melo-tts-metadata-creator" (wangminrui2022/melo-tts-metadata-creator) from ClawHub.
Skill page: https://clawhub.ai/wangminrui2022/melo-tts-metadata-creator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install melo-tts-metadata-creator

ClawHub CLI

Package manager switcher

npx clawhub@latest install melo-tts-metadata-creator
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code's functionality (finding wav/txt, optional Whisper transcription, producing metadata.list) matches the description. However, additional capabilities — heavy dependency management, automatic venv creation, CUDA detection and installing GPU/CPU PyTorch wheels and other audio libraries — are broader than the narrow purpose of producing a metadata.list and should be justified.
!
Instruction Scope
SKILL.md instructs running the generator script, which is reasonable, but the actual code triggers package installation and setuptools downgrades at module-import time (ensure_package.fix_setuptools() and ensure_package.pip calls occur during import). That means simply importing or running the script can modify the host Python environment, examine system tools (nvidia-smi), create directories (models, logs, venv) and restart the process — scope creep beyond just reading audio/text and writing metadata.
!
Install Mechanism
There is no formal install spec; instead the code calls pip at runtime to install packages (openai-whisper, torch, torchaudio, audio-separator, librosa, etc.) and even forces setuptools to a legacy version. These are network downloads from PyPI / PyTorch indexes and will write to disk. The runtime install operations run automatically and are not constrained to an explicitly created venv (see ordering concern below).
!
Credentials
The skill declares no required env vars, but it reads/sets RUNNING_IN_VENV and probes system paths (nvidia-smi). More importantly, top-level imports call functions that alter the Python environment (downgrading setuptools, pip installing packages) which is disproportionate to generating a metadata file and unexpected given the SKILL.md promise to use a models/ directory and venv. No secret exfiltration code is present, but the global package modifications are intrusive.
Persistence & Privilege
always:false and no cross-skill config changes — the skill does not request permanent platform elevation. However it creates a venv and writes logs/models/metadata into the skill root (ProjectPaths.MODEL_DIR, LOG_DIR, VENV_DIR). Combined with automatic package installs and a restart into the venv, this grants sustained filesystem and environment presence on the host which the user should be aware of.
What to consider before installing
This skill's primary feature (building MeloTTS metadata.list, optional Whisper transcription) appears legitimate, but it will automatically modify your Python environment at import/runtime: it downgrades setuptools, issues pip installs, detects GPUs, creates a venv and may restart the script inside it. These actions can affect your system Python or install large packages (torch, whisper). Before installing or running: 1) review and, if necessary, modify the code so package installs occur only after a controlled venv is created (move ensure_package.pip calls after venv setup); 2) run the skill inside an isolated environment (container or dedicated virtual machine) or a user-created venv you trust; 3) audit network access and disk writes (models/, logs/, venv/) and ensure you accept large downloads; 4) if you only need metadata generation and already have transcriptions, consider running a trimmed-down version that skips automatic package installs/Whisper to avoid environment changes.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspython
latestvk97cgjtkvjeq0gf27e60e588tx857frw
245downloads
0stars
7versions
Updated 1w ago
v1.0.6
MIT-0

melo-tts-metadata-creator

功能:专为 MeloTTS 训练/微调设计的 metadata.list 生成工具。支持单音色与多音色模式,特别适配 wav 文件和 txt 转录文件位于两个不同目录、每个子目录代表一个说话人的场景。

触发时机(Triggers)

  • 用户提到 “MeloTTS”“metadata.list”“训练数据准备”“微调数据集”
  • 用户有 wav 音频文件夹和对应 txt 转录,需要生成训练所需的 metadata 文件
  • 需要自动转录(无 txt 时用 Whisper)
  • 想处理多说话人(多音色)数据集

核心优势

  • 支持 wav 和 txt 分离存放(目录结构完全一致)
  • 自动按第一级子目录名称提取 speaker(多音色模式)
  • 支持 --speaker 参数强制统一说话人(单音色模式)
  • 内置 Whisper 自动转录功能(无 txt 时自动生成)
  • Whisper 模型下载到 ./models/ 目录
  • 生成完全符合 MeloTTS 官方最新标准的 metadata.list(UTF-8 无 BOM)
  • 转录失败时优雅跳过,继续处理其他文件

支持的模型(推荐顺序)

  1. openai/whisper-base(平衡速度与准确率)

参数提取指南

当决定调用此技能时,请从用户消息中提取以下参数:

  1. --wav_dir (必填): 音频文件所在目录
  2. --txt_dir (选填): 文本转录文件所在目录(若不提供且启用 Whisper,则自动转录)
  3. --speaker (选填): 强制指定统一说话人名称(单音色模式)
  4. --lang (选填): 语言代码,如 ZHEN
  5. --output (选填): 输出 metadata.list 的路径(默认当前目录)
  6. --recursive (选填): 是否递归处理子目录
  7. --use_whisper (选填): 是否强制使用 Whisper 转录

执行步骤

  1. 解析目录:自动识别 --wav_dir 和 --txt_dir,支持多级子目录结构。

  2. 默认目标:若未指定 --output,默认在当前工作目录生成 metadata.list

  3. 调用命令:使用以下兼容性命令启动脚本(优先 python3,失败则 python)。脚本会自动检测 Whisper 依赖。

    (python3 scripts/generate_metadata_list.py --wav_dir "<音频目录>" --txt_dir "<文本目录>" [--speaker <姓名>] [--lang {ZH,EN}] [--output <路径>] [--recursive] [--use_whisper]) || (python scripts/generate_metadata_list.py --wav_dir "<音频目录>" --txt_dir "<文本目录>" [--speaker <姓名>] [--lang {ZH,EN}] [--output <路径>] [--recursive] [--use_whisper])
    

Comments

Loading comments...