Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent cloud text-to-speech helper, but its voice-cloning workflow uploads sensitive voice samples without clear consent, privacy, or retention safeguards.
Review before installing. Use this only if you are comfortable sending TTS text and any reference voice recordings to SiliconFlow. Do not submit secrets, regulated data, or voices you do not own or have explicit permission to clone. Treat the API key and cloned voice URI as sensitive, and clean up generated audio or provider-side custom voices when no longer needed.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
注意：使用自定义音色（声音克隆）需要完成实名认证
The voice-cloning workflow tells users to upload a reference voice sample and reuse the returned voice identifier, but omits any warning about consent, biometric sensitivity, impersonation risk, or downstream retention by the remote provider. Voice data is especially sensitive because it can enable spoofing, identity abuse, and unauthorized cloning of another person's speech.
The skill sends user-provided text to SiliconFlow for synthesis and, for voice cloning, instructs uploading reference voice audio to the provider, but it does not prominently warn users that this content leaves the local environment. This creates a real privacy risk because sensitive text, biometric voice data, and associated metadata may be transmitted to and processed by a third party without informed consent.
The direct reference to the SiliconFlow API endpoint confirms use of an external service. In this skill context the endpoint itself is not malicious, but its use means user content and bearer-authenticated requests leave the local trust boundary.
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
The direct reference to the SiliconFlow API endpoint confirms use of an external service. In this skill context the endpoint itself is not malicious, but its use means user content and bearer-authenticated requests leave the local trust boundary.
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
This endpoint reference supports external processing of dialogue synthesis. The risk is contextual rather than inherently malicious: the skill is designed for cloud TTS, but users are not adequately warned that their text is sent off-device.
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
This endpoint reference supports external processing of dialogue synthesis. The risk is contextual rather than inherently malicious: the skill is designed for cloud TTS, but users are not adequately warned that their text is sent off-device.
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
Uploading reference audio for voice cloning sends biometric voice data to an external provider, which is substantially more sensitive than ordinary text submission. Combined with the note about real-name verification, this raises elevated privacy and misuse concerns because voiceprints may enable impersonation, identity linkage, or long-term biometric exposure.
# 先上传参考音频（一次性操作，30秒以内的清晰录音）
curl --location 'https://api.siliconflow.cn/v1/uploads/audio/voice' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--form 'model="FunAudioLLM/CosyVoice2-0.5B"' \
--form 'customName="my-voice"' \
This cloned-voice synthesis request uses a previously uploaded custom voice identifier with the external service, meaning personalized voice assets and input text are processed remotely. The presence of custom cloned voices increases the chance of misuse for impersonation or unauthorized reproduction of a person's voice.
# 返回 uri 字段，格式：speech:my-voice:xxxxx:xxxxx
# 将 uri 作为 voice 参数使用
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
This output-path example still includes an external network request to the TTS API, so the same data-transfer risk applies. The surrounding context also normalizes automatic file creation, compounding privacy exposure by both transmitting content externally and storing the resulting audio locally.
FILENAME="tts_$(date +%Y%m%d_%H%M%S).mp3"
OUTPUT_PATH="$OUTPUT_DIR/$FILENAME"
# 完整 curl 命令示例
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
This endpoint reference in the save-path example again indicates off-device processing by SiliconFlow. While expected for a cloud TTS skill, it remains a true finding because the skill lacks a strong privacy warning and may be used on sensitive material in agent workflows.
OUTPUT_PATH="$OUTPUT_DIR/$FILENAME"
# 完整 curl 命令示例
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{...}' \
This example performs an external API call that transmits user-provided text and an API credential to a remote service. The transmission itself is expected for cloud TTS, but without contextual warnings or safeguards it creates a real data-exposure risk if users submit sensitive content.
OUTPUT_DIR="${OPENCLAW_WORKSPACE:-$PWD}/tts" && mkdir -p "$OUTPUT_DIR"
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
This example performs an external API call that transmits user-provided text and an API credential to a remote service. The transmission itself is expected for cloud TTS, but without contextual warnings or safeguards it creates a real data-exposure risk if users submit sensitive content.
OUTPUT_DIR="${OPENCLAW_WORKSPACE:-$PWD}/tts" && mkdir -p "$OUTPUT_DIR"
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
The examples instruct users to send arbitrary article/blog text to a third-party TTS API but provide no notice that the content leaves the local environment and may contain sensitive or copyrighted material. In a skill explicitly marketed for domestic use without VPN, users may be encouraged to paste large bodies of text, increasing the chance of unintentional disclosure.
This podcast-style example sends dialogue content to a third-party endpoint for synthesis. Because the skill is designed to process user-authored content, the main risk is unannounced exfiltration of potentially confidential text rather than code execution or direct compromise.
OUTPUT_DIR="${OPENCLAW_WORKSPACE:-$PWD}/tts" && mkdir -p "$OUTPUT_DIR"
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
This podcast-style example sends dialogue content to a third-party endpoint for synthesis. Because the skill is designed to process user-authored content, the main risk is unannounced exfiltration of potentially confidential text rather than code execution or direct compromise.
OUTPUT_DIR="${OPENCLAW_WORKSPACE:-$PWD}/tts" && mkdir -p "$OUTPUT_DIR"
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
This example uploads a reference audio file to a remote voice-cloning endpoint, which is a meaningful external transfer of sensitive biometric-like voice data. In the context of voice cloning, the lack of consent and privacy warnings makes the data-sharing risk substantially more dangerous than ordinary TTS input.
第一步：上传参考音频（一次性）
curl --location 'https://api.siliconflow.cn/v1/uploads/audio/voice' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--form 'model="FunAudioLLM/CosyVoice2-0.5B"' \
--form 'customName="my-voice"' \
This follow-up example sends text plus a reusable cloned-voice identifier to the remote API, enabling continued use of a previously uploaded custom voice. While normal for the feature, it increases misuse potential if the identifier corresponds to an unauthorized or sensitive voice clone.
OUTPUT_DIR="${OPENCLAW_WORKSPACE:-$PWD}/tts" && mkdir -p "$OUTPUT_DIR"
curl --location 'https://api.siliconflow.cn/v1/audio/speech' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --location 'https://api.siliconflow.cn/v1/audio/voice/list' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --location 'https://api.siliconflow.cn/v1/audio/voice/list' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --location 'https://api.siliconflow.cn/v1/audio/voice/list' \
--header "Authorization: Bearer $SILICONFLOW_API_KEY"
This markdown file includes a concrete example for deleting custom voices via the /v1/audio/voice/deletions endpoint, but it does not warn that the action removes user-created assets and may be irreversible. Under the markdown-specific warning criteria, destructive operations affecting user data should include a clear caution.
The skill documents automatic saving of generated audio into the workspace and retention of historical files, but does not present this as a user-facing warning before use. This can expose sensitive synthesized content to other local users, later agents, backups, or source-control workflows if the workspace is shared or synced.
The file’s natural-language content is exclusively Chinese, which effectively forces a specific language for users reading the skill documentation. The policy allows locale constraints only when the skill offers a language choice or clearly documents a justified region-specific limitation, neither of which appears here.
No suspicious patterns detected.