Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Dubbing

v1.2.0

🎯 **唯一使用VoxCPM的中文配音技能** - 外语视频一键中文配音,支持硬字幕检测、断点续传、智能BGM。触发场景:(1) 用户需要给外语视频配音 (2) 视频翻译需求 (3) 多语言内容本地化

0· 154·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for newaiguy/voxcpm-chinese-dubbing.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Dubbing" (newaiguy/voxcpm-chinese-dubbing) from ClawHub.
Skill page: https://clawhub.ai/newaiguy/voxcpm-chinese-dubbing
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install voxcpm-chinese-dubbing

ClawHub CLI

Package manager switcher

npx clawhub@latest install voxcpm-chinese-dubbing
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The main scripts (dubbing, add_bgm) and SKILL.md align with a video-dubbing/TTS workflow and require a translation API key and a VoxCPM model directory; however the registry metadata claims no required env vars while SKILL.md and the scripts expect TRANSLATE_API_KEY and VOXCPM_DIR. That mismatch between declared registry requirements and the runtime configuration is inconsistent and should be clarified.
!
Instruction Scope
SKILL.md and scripts perform typical tasks for the stated purpose (whisper transcription, translation API calls, TTS, ffmpeg processing). However scripts/dubbing.py and upload_bilibili.py access system files and make network calls: upload_bilibili.py loads credentials from a hardcoded absolute path (D:/openclaw_workspace/credentials/bilibili.json) and invokes a hardcoded ffmpeg path (E:/ImageMagick.../ffmpeg.exe). Those file reads and absolute-path accesses are outside the core dubbing purpose and represent scope creep (access to local credential stores).
Install Mechanism
There is no automated install spec (instruction-only). The README/SKILL.md instructs installing Python packages and cloning VoxCPM — reasonable and proportionate for a local TTS/transcription tool. Nothing in the install instructions downloads arbitrary executables from unknown servers.
!
Credentials
The runtime expects TRANSLATE_API_KEY and VOXCPM_DIR (declared in SKILL.md and used in scripts) which are reasonable. But upload_bilibili.py reads Bilibili credentials from a hardcoded system path not declared as required, and also references absolute local tools; these imply the package expects access to unrelated secrets on the host. The skill also defaults API endpoints to api.siliconflow.cn — users should verify trustworthiness of that external service before supplying keys.
Persistence & Privilege
The skill does not request always:true and has no install hooks that would force persistent system presence. It is instruction-only plus included scripts; autonomous invocation is allowed by default (normal), but there is no evidence of the skill attempting to modify other skills or system-wide settings.
Scan Findings in Context
[HARD_CODED_CRED_PATH] unexpected: scripts/upload_bilibili.py opens a hardcoded credentials file at D:/openclaw_workspace/credentials/bilibili.json. A dubbing skill should not require or assume a specific host-local credentials file. This is unexpected and possibly unsafe.
[ABSOLUTE_LOCAL_EXEC_PATH] unexpected: upload_bilibili.py invokes a hardcoded local ffmpeg path under E:/ImageMagick-7.1.1-Q16-HDRI/ffmpeg.exe. Relying on absolute local paths is fragile and may indicate the script was tailored to a single developer environment.
[NETWORK_CALLS] expected: scripts/dubbing.py uses requests.post to call translation and vision APIs (api.siliconflow.cn) which is expected for translation/vision tasks. Users should review which external endpoints will receive text and images (and whether keys will be sent).
[SUBPROCESS_EXEC] expected: Both add_bgm.py and dubbing.py use ffmpeg via subprocess; this is expected for video/audio processing.
What to consider before installing
Before installing or running: 1) Treat TRANSLATE_API_KEY as sensitive — confirm you trust the default external endpoint (https://api.siliconflow.cn) or change it to a provider you control. 2) Inspect and edit scripts/upload_bilibili.py: it reads credentials from a hardcoded Windows path and uses absolute ffmpeg paths — remove or modify this script if you do not want it to access local secrets or upload automatically. 3) If you don't need Bilibili upload functionality, delete upload_bilibili.py from the package. 4) Run the tool in an isolated environment (container or VM) and supply configuration via config.json or environment variables rather than relying on defaults. 5) Verify VoxCPM model installation location (VOXCPM_DIR) and do not place secrets in predictable paths. If any behavior is unclear, ask the skill author to explain why local credential paths are used and to provide a safe configuration option.

Like a lobster shell, security has layers — review code before you run it.

latestvk9735tmxjdyfq0h5cmd2rzssrs83w2am
154downloads
0stars
3versions
Updated 4w ago
v1.2.0
MIT-0

🎬 VoxCPM中文视频配音

唯一使用VoxCPM开源模型的中文配音技能

生产环境验证 ✅ | 断点续传 ✅ | 智能BGM ✅

🌟 核心卖点

特性说明
🎯 VoxCPM独家唯一集成VoxCPM开源TTS模型的中文配音技能
生产验证已在B站成功发布4个视频
🔄 断点续传中断后可继续,无需重新生成
🔍 硬字幕检测AI自动检测并覆盖原字幕
🎵 智能BGM自动循环、交叉淡入淡出

📋 完整流程

1. Whisper转写    → medium模型转写 + 时间戳
2. AI翻译        → 腾讯混元MT翻译模型
3. 分组TTS       → VoxCPM配音(按组生成,保持连贯)
4. 音频匹配      → 智能拉伸/加静音
5. 硬字幕检测    → AI自动检测是否需要遮盖
6. 字幕生成      → 中文字幕(自动换行)
7. 视频合并      → GPU加速编码

🚀 快速开始

1. 安装依赖

# Python依赖
pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu118
pip install openai-whisper soundfile scipy librosa requests

# VoxCPM(从官方获取)
git clone https://github.com/modelscope/VoxCPM.git

2. 配置

复制配置模板:

cp config.example.json config.json

编辑 config.json

{
  "work_dir": "./workspace",
  "voxcpm_dir": "./VoxCPM",
  "ffmpeg_path": "ffmpeg",
  "translate": {
    "api_url": "https://api.siliconflow.cn/v1/chat/completions",
    "api_key": "YOUR_API_KEY",
    "model": "tencent/Hunyuan-MT-7B"
  },
  "vision": {
    "api_url": "https://api.siliconflow.cn/v1/chat/completions",
    "model": "Qwen/Qwen2.5-VL-72B-Instruct"
  },
  "tts": {
    "reference_audio": "./reference_audio/speaker.wav",
    "reference_text": "参考音频对应的文本"
  }
}

注意: 所有配置项均可通过环境变量覆盖,优先级:环境变量 > config.json > 默认值


### 3. 运行

```bash
python scripts/dubbing.py your_video.mp4

输出:

  • workspace/output/your_video_dubbed.mp4 - 配音视频
  • workspace/output/your_video.srt - 字幕文件

⚙️ 参数说明

Whisper参数

参数默认值说明
whisper.modelmediumWhisper模型大小
whisper.languageen源语言

TTS参数

参数默认值说明
tts.max_group_duration15.0每组最大时长(秒)
tts.inference_timesteps10推理步数
tts.cfg_value2.0CFG值

字幕参数

参数默认值说明
subtitle.fontsize16字体大小
subtitle.fontnameSimHei字体名称
subtitle.outline2描边宽度

🎵 BGM添加

python scripts/add_bgm.py <视频> [BGM文件] [输出文件]

特性:

  • BGM自动循环(交叉淡入淡出3秒)
  • 音量控制(默认12%)
  • 自动淡入淡出

🔧 高级用法

测试模式

只处理前30秒:

python scripts/dubbing.py video.mp4 --test 30

指定输出名

python scripts/dubbing.py video.mp4 --output my_video

自定义配置

python scripts/dubbing.py video.mp4 --config my_config.json

📁 文件结构

video-dubbing/
├── SKILL.md              # 本文档
├── config.example.json   # 配置模板
├── scripts/
│   ├── dubbing.py       # 主流程脚本
│   ├── add_bgm.py       # BGM添加
│   └── upload_bilibili.py # B站上传
└── reference_audio/      # TTS参考音频
    └── speaker.wav

🔑 环境变量

变量说明默认值
TRANSLATE_API_KEY翻译API密钥(必需)-
VOXCPM_DIRVoxCPM目录./VoxCPM
WORK_DIR工作目录./workspace
REFERENCE_AUDIOTTS参考音频路径./reference_audio/speaker.wav
REFERENCE_TEXT参考音频对应文本-
TRANSLATE_API_URL翻译API端点SiliconFlow
TRANSLATE_MODEL翻译模型tencent/Hunyuan-MT-7B
VISION_API_URL硬字幕检测API端点SiliconFlow
VISION_MODELVision模型Qwen/Qwen2.5-VL-72B-Instruct
WHISPER_MODELWhisper模型medium
WHISPER_LANGUAGE源语言en
FFMPEG_PATHffmpeg路径ffmpeg

📊 音频匹配质量

ratio范围方法质量
< 0.85加静音✅ 无损
0.85-1.15resample✅ 轻微调整
> 1.15librosa加速⚠️ 轻微失真

实测:60%+组无损音质

⚠️ 注意事项

AV1编码视频

AV1编码视频需要重新编码:

# 使用GPU编码
-c:v h264_nvenc

# 或CPU编码
-c:v libx264

VoxCPM模型

需要从ModelScope获取VoxCPM模型:

# 下载模型到指定目录
modelscope download --model modelscope/VoxCPM --local_dir ./VoxCPM

📜 许可证

MIT License

🙏 致谢


🎯 选择VoxCPM中文配音的理由:

  1. 开源免费,无商业限制
  2. 中文效果最佳,自然流畅
  3. 支持声音克隆(参考音频)
  4. 本地运行,数据安全

Comments

Loading comments...