baiyin-cover-train-skill — 技能工具
v1.0.0当用户希望通过百音开放平台训练 AI 歌手模型、查询训练任务状态，或根据已有 taskId 返回最终训练结果时使用。
0· 1·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions describe using BAIYIN API credentials and upload endpoints, but the published metadata does not declare the required environment variables or credentials and there are minor metadata mismatches — this inconsistency merits caution before installing.
评估建议
This skill appears to be designed to call the Baiyin open platform (upload files, create training tasks, poll status) and therefore requires an API base URL and an API key — but the published manifest did not declare those required environment variables. Before installing or enabling this skill: (1) verify the publisher identity and resolve the ownerId mismatch (_meta.json vs registry listing); (2) confirm you are willing to provide BAIYIN_OPEN_URL and BAIYIN_OPEN_KEY, preferably as a short-live...详细分析 ▾
⚠ 用途与能力
The SKILL.md clearly requires BAIYIN_OPEN_URL and BAIYIN_OPEN_KEY (and uses Authorization: Bearer <API_KEY> for uploads and train/task endpoints), but the registry metadata declares no required environment variables or primary credential. That mismatch means the skill will need access to sensitive API credentials to function but the published manifest does not advertise them. Additionally, _meta.json lists ownerId "baiyin" while the registry owner ID in the package listing is different (kn70p...), which is an inconsistency in provenance/metadata.
ℹ 指令范围
The instructions are narrowly scoped to interacting with the Baiyin open platform: creating train tasks, uploading files, polling task status, and returning results. They explicitly instruct the agent to ask the user to upload local files via the platform upload API rather than inventing public URLs. The SKILL.md does not instruct the agent to read arbitrary local files or unrelated system credentials, but it does rely on conversation context (e.g., reusing taskId from the session), which is expected. Overall scope is appropriate for the stated purpose, aside from the credential omission noted above.
✓ 安装机制
Instruction-only skill with no install spec and no bundled code — lowest install risk. The skill will operate by making HTTP calls as described; nothing is written to disk by an installer.
⚠ 凭证需求
Functionally the skill legitimately needs two pieces of configuration (BAIYIN_OPEN_URL and BAIYIN_OPEN_KEY) to call the platform, and the SKILL.md documents their use. However, the skill's published requirements do not declare these env vars or any primary credential. The omission is a proportionality and transparency problem: users are not told up front that they must provide an API endpoint and a bearer key. No other unrelated credentials are requested.
✓ 持久化与权限
always is false and disable-model-invocation is not set, which is standard. The skill does not request persistent system-wide changes or other skills' credentials in the instructions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/14
Initial release of baiyin-cover-train-skill: - Enables creation of AI singer training tasks on the Baiyin platform using a public audio URL. - Supports querying task status and retrieving final model results with taskId. - Guides users to upload files via Baiyin open file upload API if a public URL is not provided. - Implements robust parameter extraction, default value handling, task mode recognition, and clear error messaging. - Ensures correct handling of character encoding and validation of returned model names.
● 无害
安装命令 点击复制
官方npx clawhub@latest install baiyin-cover-train-skill
镜像加速npx clawhub@latest install baiyin-cover-train-skill --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制