Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Text To Podcast

v1.0.0

将文本转换为播客音频(使用 TTS)

0· 129·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, Python code, and skill.json align: the tool converts text to audio and uses OpenAI TTS. However, the registry summary at the top of the package metadata claimed 'Required env vars: none' while skill.json and SKILL.md require OPENAI_API_KEY — an inconsistency that should be resolved.
Instruction Scope
SKILL.md and the Python code stick to the stated purpose: reading text files, calling a TTS API, and writing MP3 output. No instructions to read unrelated system files or exfiltrate data are present.
Install Mechanism
install.sh is a local shell script that runs pip3 install openai python-dotenv and creates a local .env and output directory — no remote downloads or obscure URLs. One functional gap: install.sh does not create a 'text-to-podcast' executable or symlink despite SKILL.md examples and skill.json expose listing that command, so the advertised CLI may not be available after installation unless the platform provides the mapping.
Credentials
The only credential needed is an OpenAI API key (declared in skill.json and referenced in SKILL.md/.env and the code), which is proportionate to calling OpenAI's TTS. Again, the package-level metadata erroneously said no env vars are required — this mismatch should be corrected so users know they must supply an API key.
Persistence & Privilege
The skill does not request elevated privileges, persistent 'always' inclusion, or modifications to other skills. install.sh writes a local .env and output directory inside the skill workspace and makes the script executable — typical behavior for an instruction-only skill with local state.
What to consider before installing
What to check before installing: - The skill needs your OpenAI API key (OPENAI_API_KEY). Only provide a key you control and are comfortable using for TTS requests. If you use a high-privilege key, consider creating a scoped/limited key if your account supports it. - install.sh will pip-install the 'openai' and 'python-dotenv' packages into the system Python environment. If you prefer isolation, run it inside a virtualenv or container. - install.sh creates a .env file with a placeholder in the skill folder and an 'output' directory. The uninstall script can remove these, but you should inspect and, if desired, delete the .env (it contains your key) after uninstalling. - The package advertises a 'text-to-podcast' CLI but install.sh does not create a named executable or PATH entry; you may need to run the Python script directly (python3 source/podcast_generator.py ...) or create your own wrapper. Confirm how the platform exposes commands before relying on the SKILL.md examples. - Review source/podcast_generator.py yourself; it appears to only call OpenAI's API and do local file I/O (no hidden endpoints). If you want higher assurance, run it in an isolated environment and monitor network calls to confirm they go only to OpenAI. - The top-level registry metadata contradicts the embedded files about required env vars; ask the publisher or maintainer to correct this before use. If these issues are acceptable and you run the install in an isolated environment, the skill appears internally consistent with its stated purpose. If you need definitive assurance, request corrected registry metadata and a clear CLI installation step from the maintainer.

Like a lobster shell, security has layers — review code before you run it.

audiovk97549yn9p2sw2s6ec6fcj72g582yxnplatestvk97549yn9p2sw2s6ec6fcj72g582yxnppodcastvk97549yn9p2sw2s6ec6fcj72g582yxnpttsvk97549yn9p2sw2s6ec6fcj72g582yxnp

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Text to Podcast - 文本转播客

快速将文章、脚本转换为高质量播客音频。

功能

  • 🎙️ TTS 转换:使用 OpenAI TTS API(或系统 TTS)
  • 🎵 多种声音:alloy, echo, fable, onyx, nova, shimmer
  • 批量处理:一次转换多个文本文件
  • 📦 输出格式:MP3(高质量 24kHz)
  • 🎚️ 音量/速度:可调节语速
  • 👀 预览模式:只生成前10秒试听
  • ↩️ 撤销:自动备份原始文本

快速开始

安装

clawhub install text-to-podcast
cd ~/.openclaw/workspace/skills/text-to-podcast
./install.sh

配置

export OPENAI_API_KEY="your-key"

使用

# 单个文件
text-to-podcast convert script.md --voice alloy --output podcast.mp3

# 批量
text-to-podcast batch ./scripts/ --output ./podcasts/

# 预览(10秒)
text-to-podcast convert script.md --preview

# 调整语速
text-to-podcast convert script.md --speed 1.2

参数

参数类型必需描述
input路径输入文本文件
--voice选项声音:alloy/echo/fable/onyx/nova/shimmer(默认:alloy)
--output路径输出MP3文件
--speed浮点数语速倍数(0.5-2.0,默认:1.0)
--preview布尔预览模式(只生成前10秒)
--model选项TTS 模型:tts-1/tts-1-hd(默认:tts-1)

声音选择

  • alloy:中性,适合新闻、访谈
  • echo:温暖,适合故事、播客
  • fable:清晰,适合教育内容
  • onyx:低沉,适合深度内容
  • nova:轻快,适合娱乐、轻松话题
  • shimmer:空灵,适合冥想、放松

使用场景

  • 文章转播客(多平台内容再利用)
  • 脚本试听(内容创作前测试)
  • 快速生成音频内容
  • 与 content-researcher + ai-content-tailor 配合形成完整工作流

License

MIT

Files

5 total
Select a file
Select a file to preview.

Comments

Loading comments…