smart-tts

智能语音合成。自动尝试多种模型/音色，直到成功。解决 418 资源未开通问题。

Security Scan

The skill's code and instructions match a TTS purpose, but registry metadata omits a required DASHSCOPE_API_KEY and the skill depends on an undeclared Python package (dashscope), which is an inconsistency you should resolve before trusting it.

Purpose & Capability

The name/description (智能语音合成，自动尝试多种模型/音色) match the code and SKILL.md: both scripts call a dashscope SpeechSynthesizer and attempt multiple model/voice combos. However, the registry metadata lists no required environment variables or dependencies, while both SKILL.md and the scripts require DASHSCOPE_API_KEY and import the external 'dashscope' package — this mismatch is an incoherence (likely sloppy metadata or missing declarations).

Instruction Scope

The SKILL.md instructions are narrowly scoped: set DASHSCOPE_API_KEY, run generate.py or batch.py. The scripts only call the dashscope TTS API, write WAV files to ~/.openclaw/workspace, and do not access other system files, network endpoints outside the dashscope client, or additional environment variables. No evidence of data exfiltration in the scripts themselves.

Install Mechanism

There is no install spec (instruction-only install), which is lower risk, but the Python code imports 'dashscope' without declaring it in the registry metadata. That omission is risky because you need to know where to get that package and which version to trust. If a user installs a trojanized package named 'dashscope' from an untrusted source, arbitrary code could run. The skill should declare its dependency and preferred install source/version.

Credentials

The only secret the scripts require is DASHSCOPE_API_KEY, which is proportionate for a TTS client. The problem is the registry metadata did not declare this required env var; SKILL.md and the scripts do. This mismatch reduces transparency and is worth flagging, but the requested credential itself is appropriate for the stated purpose.

Persistence & Privilege

The skill does not request 'always: true' and does not modify other skills or system-wide settings. It only writes output WAV files to ~/.openclaw/workspace, which is reasonable for its function.

What to consider before installing

This skill appears to do what it says (tries multiple model/voice combos via a dashscope TTS client and saves WAV files), but the package metadata is inconsistent: SKILL.md and the scripts require DASHSCOPE_API_KEY and import a third‑party Python package 'dashscope' that is not declared in the registry. Before installing or running: 1) Verify the source and legitimacy of the 'dashscope' Python package (prefer a known PyPI project or vendor URL and pin a specific version). 2) Confirm the DASHSCOPE_API_KEY provider — only supply credentials you trust and consider using a key with limited scope. 3) Run the code in an isolated/sandbox environment if you cannot verify the dependency. 4) Optionally inspect the installed 'dashscope' package code for unexpected network calls or filesystem access. These steps reduce the risk from missing dependency metadata and potential supply-chain issues.

Smart TTS - 智能语音合成

自动尝试多种模型和音色组合，直到成功生成语音。

使用方法

1. 配置 API Key

在环境中设置：

# Windows
set DASHSCOPE_API_KEY=你的百炼APIKey

# 或在 openclaw.json 中配置

2. 生成语音

python skills/smart-tts/scripts/generate.py "要生成的文字"

3. 批量生成

python skills/smart-tts/scripts/batch.py

可用音色

模型	音色	特点
cosyvoice-v2	longshao_v2	成熟稳重男
cosyvoice-v2	longanyang	阳光大男孩
cosyvoice-v3-flash	longanyang	阳光大男孩
cosyvoice-v3-flash	longanhuan	欢脱元气女
cosyvoice-v3-flash	longhuhu_v3	天真烂漫女童
cosyvoice-v3-flash	longpaopao_v3	飞天泡泡音
cosyvoice-v3-flash	longjielidou_v3	阳光顽皮男

工作原理

1. 按优先级依次尝试不同的模型+音色组合
2. 遇到 418 资源未开通错误自动切换下一个
3. 成功生成语音后自动保存
4. 全部失败则报错

输出路径

默认保存到：~/.openclaw/workspace/tts_output.wav