Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
cosyvoice-speech-synthesizer
v1.0.1让文字"开口说话"！用 AI 把任意文本变成自然流畅的语音，支持各种方言、情感和角色模仿。当你想把文章转成有声书、给视频配音、制作播客，或者只是好奇河南话/四川话怎么说时，用这个 skill。
⭐ 0· 114·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description and the script both describe a CosyVoice (阿里云百炼/DashScope) text-to-speech client — the network call to https://dashscope.aliyuncs.com/... is appropriate for that purpose. However, the registry metadata claims 'required env vars: none' while SKILL.md and scripts/synthesize.py require DASHSCOPE_API_KEY; this omission is inconsistent and reduces transparency.
Instruction Scope
SKILL.md and the script instruct the agent/user to set an API key and call the provided Python script. The runtime instructions and code only read the DASHSCOPE_API_KEY env var and send the provided text to the CosyVoice API. There are no instructions to read arbitrary local files, other credentials, or system configuration. Note: user text is transmitted to an external service (DashScope/Aliyun), so private or sensitive text will leave your environment.
Install Mechanism
No install spec is provided (instruction-only plus an included script), which is low risk from an installer perspective. However, the Python script imports 'requests' but the package metadata does not declare dependencies — the missing dependency declaration is a transparency issue (you must ensure the runtime has the required Python packages). No downloads from unknown URLs or archive extraction are present.
Credentials
The tool legitimately requires an API key (DASHSCOPE_API_KEY) to call the external TTS API, which is proportionate. The problem: the skill metadata does not list this required environment variable; users cannot discover the need for a secret without reading SKILL.md or the script. Also verify the API key's scope: if you reuse a broadly privileged credential (e.g., an account-wide Aliyun key) it could expose more than TTS; prefer a key with minimum necessary permissions.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills or system-wide configuration. It runs as an on-demand script and can be invoked by the agent; no elevated or persistent privileges are requested.
What to consider before installing
This skill looks like a straightforward Aliyun/DashScope TTS client, but review these before installing: 1) The SKILL.md and script require DASHSCOPE_API_KEY, yet the registry metadata doesn't declare it — you'll need to provide this env var. 2) The script sends any input text to an external endpoint (dashscope.aliyuncs.com); don't send sensitive data unless you trust the service and the API key scope. 3) Ensure your runtime has the Python 'requests' package; the skill doesn't declare dependencies. 4) Prefer using a least-privilege API key (not a full-account key). 5) If you need tighter control, inspect the full script locally and run it in an isolated environment (or sandbox) before granting network access. If you want higher assurance, ask the publisher for clarified metadata (declare required env vars and dependencies) and for provenance of the package.Like a lobster shell, security has layers — review code before you run it.
latestvk97aw1a1hqc3brh5d74c8p45qd8393mn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.