by 安全扫描
OpenClaw
可疑
medium confidence该技能通过 shell 脚本和 API 密钥（RESEMBLE_API_KEY）实现 Resemble TTS/STT 功能，逻辑与目的相符，但元数据中环境变量和二进制文件的不一致引发了安全担忧，应在信任技能前修复。
评估建议
["安装前考虑：","- 技能将发送音频和文本到 Resemble 端点，需要您的 RESEMBLE_API_KEY（脚本会检查）。在审查和信任脚本前，不要提供生产密钥。","- 注册元数据目前省略了 RESEMBLE_API_KEY 和所需的二进制文件（curl、jq、base64）。这可能是一个疏漏，但应更正——要求发布者在注册表条目中声明所需的环境变量/二进制文件。","- 自己审查两个小的 shell 脚本：它们发布到 https://app.resemble.ai 和 https://f.cluster.resemble.ai，轮询作业状态，并将合成的 MP3 写入 /tmp。确认这些端点是您预期的官方 Resemble 域名。","- 了解转录和音频将上传到第三方服务。如果处理敏感音频，考虑使用一次性或有限范围的 API 密钥进行测试，并在暴露后旋转密钥。","- 如果想要更高的保证，要求作者（a）修复注册元数据以列出 RESEMBLE_API_KEY 和所需的二进制文件，（b）提供来源或主页，（c）解释为什么使用两个不同的 Resemble 主机用于 TTS 与 STT。...详细分析 ▾
ℹ 用途与能力
The name/description (Resemble TTS & STT) matches the included scripts and docs: both scripts call Resemble API endpoints for transcription and synthesis. Requiring an API key for Resemble is expected. However, the registry metadata lists no required env vars or binaries while the included .md files and scripts require RESEMBLE_API_KEY and binaries (curl, jq, base64). This metadata mismatch is inconsistent.
✓ 指令范围
The SKILL.md and the two shell scripts only perform expected actions: upload an audio file for STT, poll for job status, request TTS synth, decode base64 audio to /tmp, and echo outputs. They do not try to read unrelated system files or additional environment variables. They send data to Resemble endpoints and write temporary files under /tmp, which is consistent with the stated purpose.
✓ 安装机制
There is no install specification (instruction-only plus included shell scripts). That is low-risk compared with arbitrary downloads. The presence of executable shell scripts means code will run if invoked, but nothing in the repository performs remote code installation.
⚠ 凭证需求
The scripts and per-command metadata require RESEMBLE_API_KEY and binaries (curl, jq, base64). The registry-level metadata, however, lists no required env vars or binaries. This divergence is concerning because an omitted required credential or binary in registry metadata could cause unexpected runtime prompts or silent failures and hides that the skill needs your API key. RESEMBLE_API_KEY is the only credential the scripts use; otherwise the requested scope is proportional to the functionality.
✓ 持久化与权限
The skill is not always-enabled and does not request special persistence or modify other skills. It only writes temporary output files to /tmp when synthesizing audio, which is reasonable for its function.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/2/24
["- 修复文件名中的拼写错误：重命名“resemble-stt.md”和“resemble-tts.md”为“ressemble-stt.md”和“ressemble-tts.md”","- 添加了新脚本文件：scripts/stt.sh 和 scripts/tts.sh，以便于命令行使用"]
● 可疑
安装命令 点击复制
官方npx clawhub@latest install ressemble
镜像加速npx clawhub@latest install ressemble --registry https://cn.clawhub-mirror.com
技能文档
该技能将 OpenClaw 与 Resemble AI HTTP API 集成，启用：
- 🎙 语音转文本（音频转录）
- 🔊 文本转语音（语音合成)
功能### resemble-tts
从文本输入生成高质量语音音频。支持：- 自定义
voice_uuid - MP3 输出格式
- Base64 音频返回### resemble-stt
- 多部分音频上传
- 自动轮询直到转录完成
- 返回清晰的转录文本
要求
您必须定义环境变量：export RESEMBLE_API_KEY="your_api_key_here"
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制