Gemini Tts — Gemini工具
v1.0.0[AI辅助] Custom TTS using Gemini 2.5 Flash for high-quality, persona-driven voice output.
0· 265·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
high confidenceThe skill is a Gemini TTS client but its metadata omits a required GEMINI_API_KEY and the code/instructions contain small inconsistencies (hard-coded voice, API key passed in URL) that make the package's requirements and behavior unclear — review before installing.
评估建议
This skill appears to be a simple Gemini TTS client, but there are a few red flags to address before installing: (1) The script and SKILL.md require GEMINI_API_KEY but the registry metadata does not declare it — assume you must supply a sensitive API key. Only provide a key with minimal permissions and rotate it after testing. (2) The script sends the API key in the URL query string, which can expose it in logs; prefer using an Authorization header (Bearer token). (3) The --voice argument is ign...详细分析 ▾
ℹ 用途与能力
The name, description, SKILL.md and the code all indicate a Gemini TTS client (calls Google generativelanguage endpoint and writes audio to disk), so purpose and capability mostly align. However, the code hard-codes a prebuilt voice ('Puck') and ignores the --voice/voice_id argument, which is inconsistent with the advertised 'persona-driven' voice selection.
⚠ 指令范围
SKILL.md tells the agent to run the included script and states 'Needs GEMINI_API_KEY', but the registry metadata did not declare any required env vars. The script contacts a remote API (generativelanguage.googleapis.com), decodes base64 inline audio, and writes a local file (output_voice.*). These actions are consistent with TTS but the mismatch between SKILL.md, metadata, and the script is problematic and could lead to accidental exposure of credentials or unexpected behavior.
✓ 安装机制
There is no install spec (instruction-only plus one script). That’s low install risk because nothing is automatically downloaded or written to disk during installation beyond the included files.
⚠ 凭证需求
The code and SKILL.md require GEMINI_API_KEY (sensitive). The skill metadata did not declare any required env vars or a primary credential, which is inconsistent and may hide the fact that you must provide a secret. Also the script places the API key in the URL query parameter ( ?key=... ), which can expose the key in logs and is less secure than using an Authorization header.
✓ 持久化与权限
The skill does not request persistent presence (always is false) and does not attempt to modify other skills or system-wide config. It only writes output audio files to the working directory when run.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/15
- Initial release of gemini-tts skill. - Provides high-quality, persona-driven text-to-speech using Gemini 2.5 Flash. - Supports custom voice generation via command line. - Requires GEMINI_API_KEY for configuration.
● 无害
安装命令 点击复制
官方npx clawhub@latest install gemini-tts
镜像加速npx clawhub@latest install gemini-tts --registry https://cn.clawhub-mirror.com
技能文档
This skill allows generating custom audio output using the Gemini Flash 2.5 model.
Usage
uv run ~/.openclaw/workspace/skills/gemini-tts/generate_voice.py --text "你的内容" --voice "little-claw-persona"
Features
- Custom voice generation
- Persona-driven tone
- High quality 输出
Configuration
- Needs GEMINI_API_KEY
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制