by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill is coherent for using audio.z.ai via the uvx CLI, but be careful with the auth token. The SKILL.md asks you to copy a token from browser localStorage — treat that token like a password: don't paste it into public places, prefer creating a scoped API key if the service provides one, and store it in a secure credential store rather than a plain environment file if possible. Before installing, verify the source of the 'uv' package (brew/pypi) to ensure you're installing the intended uvx ...详细分析 ▾
✓ 用途与能力
Name/description (GLM-TTS via uvx) match the declared requirements: uvx binary and ZAI_AUDIO_USERID / ZAI_AUDIO_TOKEN environment variables are exactly what a CLI client to audio.z.ai would need.
ℹ 指令范围
SKILL.md only instructs running the uvx CLI with arguments and how to obtain credentials. It explicitly tells users to extract auth info from browser localStorage (JSON.parse(localStorage['auth-storage']).state.token), which is sensitive but directly related to authenticating to audio.z.ai; the instructions do not attempt to read other system files or unrelated credentials.
ℹ 安装机制
Install spec uses common package managers (brew or pip) for a package named 'uv' that provides uvx. Having both brew and pip installers is redundant but not inherently risky; no arbitrary download URLs or extracted archives are present.
ℹ 凭证需求
Only two env vars (userId and token) are required, and the token is the primary credential — appropriate for a remote TTS service. However the recommended method to obtain them (copying a session token from localStorage) can encourage insecure handling of session tokens and may expose long-lived credentials if not managed carefully.
✓ 持久化与权限
Skill does not request always:true, does not declare config paths, and does not modify other skills; autonomous invocation is default but not excessive for this type of integration.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/2/24
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install zai-tts
镜像加速npx clawhub@latest install zai-tts --registry https://cn.longxiaskill.com