Deepdub TTS

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: deepdub-tts Version: 0.1.5 The skill is designed to convert text to speech using the Deepdub API. All accessed environment variables (`DEEPDUB_API_KEY`, `DEEPDUB_VOICE_PROMPT_ID`, `OPENCLAW_MEDIA_DIR`) are directly relevant to its stated purpose. The `deepdub_tts.py` script writes audio files only to the `OPENCLAW_MEDIA_DIR` (controlled by environment variable, not user input), preventing arbitrary file writes. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md`. The code is clear, straightforward, and aligns perfectly with its described functionality.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any text synthesized by the skill may be processed by Deepdub, so private or sensitive content should be handled according to the user's Deepdub account and data policies.

Why it was flagged

The user-provided text is sent to Deepdub's TTS API. This is expected for the skill's purpose, but it is still third-party processing of the text.

Skill content

kwargs = {
        "text": args.text,
        "voice_prompt_id": args.voice_prompt_id,
        "locale": args.locale,
    }
...
    audio_bytes = client.tts(**kwargs)

Recommendation

Use the skill only for text you are comfortable sending to Deepdub, and review Deepdub's privacy and retention terms for sensitive use cases.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Requests will be made under the configured Deepdub key; using the shared trial key may be rate-limited and is not appropriate for private or production content.

Why it was flagged

The skill requires Deepdub credentials and also provides shared trial credentials. This is disclosed and relevant to the TTS function, but it affects which account authorizes requests.

Skill content

Required:
- `DEEPDUB_API_KEY` – your Deepdub API key
- `DEEPDUB_VOICE_PROMPT_ID` – default voice prompt to use
...
### Free Trial Credentials
For testing only, you can use these free trial credentials:

Recommendation

Configure your own Deepdub API key for real use, keep it in environment variables, and avoid using the trial credentials for sensitive text.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future installs could receive a different SDK version than the one the skill author tested.

Why it was flagged

The dependency is not version-pinned. Installing the Deepdub SDK is expected for this skill, but an unpinned package can change over time.

Skill content

deepdub

Recommendation

Install from a trusted package index and consider pinning a known-good Deepdub SDK version in controlled environments.