by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, instructions, and requirements are consistent with a TTS wrapper around the node-edge-tts library; it requests no unrelated credentials or elevated privileges.
评估建议
This package is internally consistent with a Microsoft Edge TTS wrapper: it installs npm dependencies, makes outbound calls to the Edge TTS service, and stores preferences in ~/.tts-config.json. Before installing: (1) review the node-edge-tts package source (npm/github) and package-lock to confirm you trust the versions; (2) be aware the scripts will run JavaScript from npm packages (npm packages can execute arbitrary code during install/run); (3) the config includes a proxy field — do not set i...详细分析 ▾
✓ 用途与能力
Name/description match the included scripts and package.json. Declared dependencies (node-edge-tts, commander) and the CLI/helper scripts are appropriate for a Text‑to‑Speech skill; nothing in the manifest requests unrelated cloud credentials, OS tools, or privileged access.
ℹ 指令范围
SKILL.md stays on‑topic: it instructs agents to call the built‑in tts tool or the included scripts, documents options, and shows how to install and test. The scripts read/write a per‑user config (~/.tts-config.json) and write audio to a temp dir; they also accept a proxy option. Note: SKILL.md references an external preview site (https://tts.travisvn.com) — a third‑party testing URL that is separate from Microsoft Edge endpoints and should be validated if you plan to trust it.
✓ 安装机制
No high‑risk download/install host is used. Install flow is npm install in the scripts directory (install.sh provided). Dependencies are from the public npm registry and package-lock.json lists expected packages; nothing is fetched from obscure shorteners or arbitrary URLs.
✓ 凭证需求
The skill declares no required environment variables or credentials. The config manager persists user preferences to ~/.tts-config.json (voice, proxy, timeout, etc.), which is proportional for a user‑configurable TTS client. Be aware the proxy field could be pointed at a capture proxy by a user or operator — the skill will route requests there if configured.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system settings. Its persistent footprint is limited to a per‑user config file and temporary audio files in the system temp directory, which is appropriate for this functionality.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.02026/1/25
**Major upgrade with added scripts, configurability, and streamlined TTS triggers** - Added Node.js scripts for TTS conversion and config management (`tts-converter.js`, `config-manager.js`), with installation and usage instructions. - Added resource and reference files, including a complete voice/option guide and install script. - Changed TTS intent detection to trigger only on the "tts" keyword (removes long trigger phrase lists), and clarified keyword filtering prior to conversion. - Expanded documentation with workflow, usage examples, advanced configuration, troubleshooting, and testing instructions. - Clarified default voice, output formats, temporary file handling, and recommended voice test site.
● 无害
安装命令
点击复制官方npx clawhub@latest install edge-tts
镜像加速npx clawhub@latest install edge-tts --registry https://cn.longxiaskill.com