LiveVideoStore

Python-based LiveVideoStore client with voice interaction, GUI, volume control, session management, and encrypted audio transmission for live streaming.

Security Scan

The code implements live audio capture and encrypted streaming to hard-coded third‑party servers and posts device identifiers to an OTA API, but those remote endpoints and data exfiltration are not disclosed in the SKILL.md and the source is unknown — proceed with caution.

Purpose & Capability

The skill's code matches the declared purpose (voice interaction, GUI, audio encryption/streaming, session management). However the code also includes hard-coded network endpoints (https://api.tenclass.net/xiaozhi/ota/, UDP server 120.24.160.13:8884, and console link xiaozhi.me) and posts device details to an OTA API — these remote components are not documented in SKILL.md or the skill metadata. Also the repository includes device-config.json but the code reads/writes device_config.json (underscore vs dash), which is an incoherence that may change runtime behavior.

Instruction Scope

SKILL.md only instructs 'python ult-xiaoyou.py' and lists features, but does not disclose that the program will: capture microphone audio and stream it over UDP to a remote IP, connect to an OTA API and fetch MQTT broker info, subscribe to MQTT topics, or transmit device identifiers (device_id, MAC). The runtime instructions do not warn about third‑party network traffic, the specific servers contacted, or the need to trust remote services.

Install Mechanism

This is an instruction-only skill (no platform install spec); required Python packages are listed in requirements.txt and are plausible for an audio streaming client. No arbitrary download/install URLs or archive extraction are present in the manifest.

Credentials

The skill requests no environment variables or credentials, but it collects and persists device identifiers (device_id, mac) and uses them when posting to an OTA endpoint. It also uses a hard-coded remote UDP server and dynamically generated AES keys sent only locally (in memory) but used to encrypt outbound audio packets to a third party. Transmitting microphone audio and identifying information to unknown remote hosts is a sensitive capability that is not explained or justified in the documentation.

Persistence & Privilege

The skill is not always-enabled and does not request system-wide privileges. It writes a local device_config file under the working directory and opens network sockets; it does not modify other skills or system configuration according to the code reviewed.

What to consider before installing

This package will capture microphone audio and send it (encrypted) to remote servers and will POST device identifiers to an OTA API. The SKILL.md does not list the external endpoints used. Before installing or running it: (1) verify the source and provenance — prefer code from a trusted repository and maintainer; (2) inspect the full script locally and search for network endpoints (you can grep for 'api.tenclass.net', '120.24.160.13', 'xiaozhi.me'); (3) run it in a sandbox or isolated VM if you want to test; (4) if you need the functionality but worry about privacy, consider modifying the code to point to a server you control or remove outbound network calls; (5) be aware it will persist a device_config file in the working directory and open UDP/MQTT connections; (6) don't run this on machines with sensitive audio or on networks where sending device identifiers is unacceptable. If you can, ask the publisher for documentation about the remote services and policies for stored/transmitted audio and device metadata before use.

ult-xiaoyou

项目简介

ult-xiaoyou 是一个使用 Python 实现的小优语音客户端，旨在通过代码实现直播应用功能。

功能特点

• 语音交互
• 图形化界面
• 音量控制
• 会话管理
• 加密音频传输

环境要求

• Python 3.8+（推荐 3.12）
• Windows/Linux/macOS

运行

python ult-xiaoyou.py

使用说明

• 启动应用程序后，会自动连接
• 点击并按住 "按住说话" 按钮开始语音交互
• 松开按钮结束语音输入

已知问题

• 需要稳定的网络连接
• 音频设备兼容性可能存在差异

项目优化

• 优化了 goodbye 后无法重连问题

贡献

欢迎提交 Issues 和 Pull Requests！

免责声明

本项目仅用于学习和研究目的，不得用于商业用途。