Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

SenseAudio Podcast Generator

v1.0.4

双主播播客生成器 - 输入话题自动生成播客音频,支持LLM智能生成脚本、克隆音色、文字生成音色、自定义语速语调、多种音色可选

0· 64·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for cowboy231/senseaudio-podcast-generator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "SenseAudio Podcast Generator" (cowboy231/senseaudio-podcast-generator) from ClawHub.
Skill page: https://clawhub.ai/cowboy231/senseaudio-podcast-generator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install senseaudio-podcast-generator

ClawHub CLI

Package manager switcher

npx clawhub@latest install senseaudio-podcast-generator
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (generate podcast audio via SenseAudio + ffmpeg) is reasonable and matches many files (FLask service, TTS, FFmpeg usage). However the code also expects and reads the user's ~/.openclaw/openclaw.json, extracts gateway tokens and Feishu appId/appSecret, and interacts with a local OpenClaw gateway and an IM pipeline. Those capabilities (reading agent config and messaging credentials) are not reflected in the registry metadata (which listed no required env or config paths) and are broader than a pure TTS/podcast generator would need.
!
Instruction Scope
SKILL.md instructs launching a local web server and running scripts/generate.py, which is expected. But the runtime instructions and the shipped code instruct the agent to: read ~/.openclaw/openclaw.json, read /tmp/openclaw-runtime-context.json, call a local gateway (http://localhost:18789), invoke the 'openclaw' CLI to send messages, and upload files to Feishu using appId/appSecret read from the config. These actions reach into user configuration and messaging subsystems beyond simple TTS generation.
Install Mechanism
No install spec is provided (instruction-only install). No external downloads or archive extraction are present in the manifest. Risk from install mechanisms is low; the primary surface is the runtime behavior of the shipped scripts.
!
Credentials
SKILL.md metadata declares requiring FFmpeg and SENSEAUDIO_API_KEY (primaryEnv). The code, tests, and AGENT.md also require a local openclaw.json containing SENSEAUDIO_API_KEY and channel credentials, and the code will read gateway tokens and Feishu appId/appSecret from that file. Those additional credentials and config path access are not declared in the registry metadata, and they expose sensitive secrets (app secrets, gateway tokens) that are not strictly necessary for TTS generation if the agent had been designed to accept explicit tokens as ephemeral inputs.
Persistence & Privilege
The skill does start background processes (Flask service), writes PID/log files under /tmp, and can invoke local CLI 'openclaw' to send messages. It does not set always:true and does not modify other skills' configs, but running background services and invoking local message APIs means the skill can act on IM channels when invoked. This is expected for a messaging-integrated generator but increases potential impact if combined with undisclosed credential access.
Scan Findings in Context
[reads_openclaw_config] unexpected: generate.py and tests explicitly load ~/.openclaw/openclaw.json to obtain SENSEAUDIO_API_KEY, gateway tokens, and Feishu appId/appSecret. Reading a user agent config file (and extracting app secrets) is broader than the declared single SENSEAUDIO_API_KEY requirement and should be declared and justified.
[feishu_upload_using_app_secret] expected: Uploading generated audio to Feishu is consistent with the skill's IM delivery features; however the code obtains app_id/app_secret from openclaw.json instead of requiring the user to provide a distinct upload token. The use is expected for Feishu upload, but the manner (reading local config containing secrets) should be explicit to the user.
[calls_local_gateway_and_cli] expected: The skill calls a local OpenClaw gateway (http://localhost:18789) and may invoke 'openclaw message send' via subprocess. This aligns with the described IM delivery behavior, but it implies the skill will use local messaging credentials and possibly send files through the agent automatically.
[hardcoded_paths_and_tokens] unexpected: The code uses hard-coded project paths (/home/wang/桌面/龙虾工作区/...), a default Feishu folder token 'DtGffqCRTl0s3Rdv56DcAGghnyb', and default output dirs. Hard-coded local paths and tokens are brittle and may leak test/demo values; presence of these suggests the package was packaged from a developer's workstation and could unexpectedly reference user-local paths.
What to consider before installing
Things to consider before installing: - Metadata mismatch: The registry entry listed no required env or config paths, but SKILL.md and the shipped scripts require FFmpeg and SENSEAUDIO_API_KEY and also read your ~/.openclaw/openclaw.json for gateway tokens and Feishu app credentials. Expect the code to access that file and use any credentials inside. - Sensitive data access: The skill will try to read appId/appSecret and gateway tokens from your OpenClaw config and use them to upload audio to Feishu and send messages via the local gateway or 'openclaw' CLI. If you keep other service credentials in openclaw.json, those could be read at runtime. Only install if you trust the author and are comfortable with the skill accessing that config file. - Tests and runtime require openclaw.json: The included tests assert that openclaw.json exists and contains SENSEAUDIO_API_KEY, so installing/running tests may fail or leak info if you don't have a safe test config. The code also contains hard-coded demo folder tokens and project paths—inspect and remove them if necessary. - Mitigations and next steps: - Inspect ~/.openclaw/openclaw.json yourself before running; remove or move unrelated secrets you don't want the skill to see. - Prefer providing needed tokens explicitly (SENSEAUDIO_API_KEY and an upload token) rather than leaving app secrets in a global config file; ask the skill author to accept explicit credentials via environment variables or secure prompts. - If you need to run it, run inside a sandboxed account or VM that does not contain other sensitive OpenClaw credentials. - Ask the author to update registry metadata to list required config paths and credentials (openclaw.json, Feishu app secrets, gateway token) so the permission model is transparent. If you are not comfortable with a skill reading local agent configuration and messaging credentials, do not install or run it until the author provides a version that requests only the minimal, explicit credentials it needs.

Like a lobster shell, security has layers — review code before you run it.

latestvk970y57f3gz22smy0e4tpqjsks8519ap
64downloads
0stars
5versions
Updated 1w ago
v1.0.4
MIT-0

Podcast Generator Skill

双主播播客生成器 - 将话题文本转换为播客音频


🚀 怎么用

方式一:启动 Web 页面

在 OpenClaw 聊天中说:

启动播客生成器

Agent 会自动启动 Web 服务并打开浏览器页面 http://localhost:5000,你可以在页面中可视化操作。

方式二:直接生成播客

在 OpenClaw 聊天中说:

播客生成器帮我生成以下话题:人工智能的未来发展

或发送完整文案:

播客生成器帮我生成以下文案:
[你的播客脚本内容]

Agent 会自动生成 MP3 音频并发送给你。


🎯 两种调用模式(按渠道自动选择)

⚠️ 重要提示:根据使用场景选择正确模式!

使用场景正确模式原因
本地终端(直接在电脑上用 OpenClaw)模式 AWeb 页面可直接打开浏览器
IM 渠道(飞书/Telegram/Discord等)模式 BWeb 页面无法远程访问,只能聊天生成

❌ 常见错误:在飞书里说 "生成播客",期望打开 Web 页面

  • 原因:Web 页面只运行在本地服务器,IM 用户无法访问
  • 正确做法:在 IM 里直接发送文案,使用模式 B

模式 A:Web 页面模式(仅限本地终端)

适用场景:用户在本地电脑直接使用 OpenClaw(非 IM 渠道)

触发关键词

  • "生成播客"
  • "播客"
  • "启动播客"

流程

  1. 启动 Flask Web 服务(端口 5000)
  2. 自动打开浏览器访问 http://localhost:5000
  3. 用户在 Web 页面操作

优势

  • 可视化界面,操作直观
  • 支持实时试听、参数调整
  • 可查看历史生成记录

⚠️ 限制:仅限本地访问,IM 渠道无法使用!


模式 B:聊天生成模式(IM 渠道默认)⭐

适用场景:通过飞书、Telegram、Discord 等 IM 渠道发送消息

触发关键词

  • "生成播客"(IM 渠道自动识别)
  • "直接生成播客"
  • 或用户直接提供播客文案

流程

  1. Agent 检测到 IM 渠道 → 自动使用模式 B
  2. 发送生成信息卡片,告知默认配置
  3. 用户回复播客文案(如果尚未提供)
  4. Agent 调用 API 生成音频
  5. 根据渠道发送结果

默认配置

  • 男声:male_0004_a(青树)
  • 女声:female_0001_a(之心)
  • 语速:1.0
  • 语调:男声 0,女声 2

渠道自动识别规则

Agent 应根据 inbound_meta.chat_typechannel 自动选择模式:

渠道类型选择模式判断条件
飞书(feishu)模式 Bchannel: "feishu"
Telegram模式 Bchannel: "telegram"
Discord模式 Bchannel: "discord"
Signal模式 Bchannel: "signal"
本地终端模式 A无 channel 信息或 chat_type: "terminal"

判断逻辑

# Agent 检测渠道
if inbound_meta.get("channel") in ["feishu", "telegram", "discord", "signal"]:
    # IM 渠道 → 模式 B(聊天生成)
    use_chat_mode()
else:
    # 本地终端 → 模式 A(Web 页面)
    start_web_server()

触发后的详细交互流程

模式 A(Web 页面)- 仅限本地终端

触发条件:用户在本地终端运行 OpenClaw

用户说:"生成播客"

Agent 执行

# 1. 启动 Web 服务(后台运行)
python3 app.py &

# 2. 打开浏览器
xdg-open http://localhost:5000

Agent 发送消息

🎙️ 播客生成器已启动!

🌐 Web 页面已打开:http://localhost:5000

在页面中你可以:
• 输入话题,AI 自动生成播客脚本
• 选择音色(支持克隆音色、文字生成音色)
• 调整语速、语调
• 实时试听效果

⚠️ 注意:此模式仅限本地访问,IM 渠道无法打开浏览器!


模式 B(聊天生成)- IM 渠道默认 ⭐

触发条件:用户通过飞书/Telegram/Discord 等 IM 渠道发送消息

用户说:"生成播客"(Agent 自动识别 IM 渠道)

Agent 发送配置卡片

🎙️ 聊天生成播客

⚠️ 你正在通过 IM 渠道使用,Web 页面无法远程访问。
当前使用聊天生成模式。

📋 默认配置:
• 男声:青树(male_0004_a)
• 女声:之心(female_0001_a)
• 语速:1.0 倍
• 语调:男声 0,女声 2

✏️ 请发送你想生成的播客文案或话题:

💡 提示:直接发送文案即可,例如:
"生成播客,话题是人工智能的未来发展"

用户回复文案后:

Agent 执行

python3 scripts/generate.py --topic "用户提供的文案"

Agent 发送结果

  • 飞书渠道:上传云盘 + 发送链接
  • 其他渠道(Telegram/Discord/Signal):直接发送 MP3 文件

⚠️ 飞书渠道重要说明

飞书不支持直接发送音频文件到对话窗口!

解决方案:上传到云盘,发送云盘链接给用户。

飞书云盘上传流程

步骤 1:获取 Folder Token

从飞书云盘文件夹 URL 直接复制 token 部分(URL 最后一段)。

步骤 2:上传到云盘

url = 'https://open.feishu.cn/open-apis/drive/v1/files/upload_all'
form = {
    'file_name': '播客_话题.mp3',
    'parent_type': 'explorer',
    'parent_node': folder_token,
    'size': file_size,
    'file': mp3_data
}

步骤 3:发送链接

🎙️ 播客已上传到云盘!

**链接**: https://my.feishu.cn/drive/file/{file_token}

点击链接即可播放!

其他 IM 渠道

渠道发送方式说明
飞书云盘上传 + 链接无法直接发音频
Telegram直接发送 MP3✅ 支持
Discord直接发送 MP3✅ 支持
Signal直接发送 MP3✅ 支持

Agent 会根据渠道自动选择正确的发送方式。


参数说明

参数默认值说明
--topic必填话题内容(建议 50-200 字)
--speed1.0语速(0.5-2.0)
--pitch-male0男声语调(-12~12)
--pitch-female2女声语调(-12~12)
--male-voicemale_0004_a男声音色 ID
--female-voicefemale_0001_a女声音色 ID
--output自动生成输出文件路径

可选音色

免费音色(默认)

音色 ID名称特点
male_0004_a青树沉稳大气
female_0001_a之心亲切自然

付费音色(SVIP 限免)

音色 ID名称特点
male_0028_d激昂解说充满激情
female_0035_d甜美解说活泼可爱

特色功能(SenseAudio 平台)

  • 🔊 克隆音色:上传音频样本克隆你的声音
  • 文字生成音色:用文字描述生成专属音色

项目依赖

依赖说明
Flask 服务端口 5000
FFmpeg音频合并(已安装)
SenseAudio TTS语音合成
qwen3.5-plusLLM 脚本生成

错误处理

错误原因解决方案
服务未启动Flask 未运行python3 app.py
API Key 无效SENSEAUDIO_API_KEY 错误检查 openclaw.json
云盘上传 forbiddenfolder_token 错误使用正确的云盘 URL
生成失败TTS API 错误检查积分余额

详细文档

完整 API 文档见:references/AGENT.md

Comments

Loading comments...