melo-tts-metadata-creator

当用户需要为 **MeloTTS** 训练或微调生成 metadata.list 文件时自动触发。 专门处理 .wav 音频文件和对应的 .txt 转录文本，自动生成符合 MeloTTS 官方最新标准的 metadata.list（格式：音频路径|speaker|语言|文本）。 支持单音色和多音色模式： - wa...

This skill's primary feature (building MeloTTS metadata.list, optional Whisper transcription) appears legitimate, but it will automatically modify your Python environment at import/runtime: it downgrades setuptools, issues pip installs, detects GPUs, creates a venv and may restart the script inside it. These actions can affect your system Python or install large packages (torch, whisper). Before installing or running: 1) review and, if necessary, modify the code so package installs occur only after a controlled venv is created (move ensure_package.pip calls after venv setup); 2) run the skill inside an isolated environment (container or dedicated virtual machine) or a user-created venv you trust; 3) audit network access and disk writes (models/, logs/, venv/) and ensure you accept large downloads; 4) if you only need metadata generation and already have transcriptions, consider running a trimmed-down version that skips automatic package installs/Whisper to avoid environment changes.

Type: OpenClaw Skill Name: melo-tts-metadata-creator Version: 1.0.6 The skill is designed to generate metadata for MeloTTS but contains high-risk environment management behaviors. Specifically, 'ensure_package.py' automatically executes 'pip install --force-reinstall' for setuptools upon being imported, and 'env_manager.py' uses 'subprocess' to create virtual environments, detect GPU hardware via 'nvidia-smi', and install large dependencies like PyTorch. While these capabilities are plausibly required for the stated purpose of audio processing and transcription, the use of automated shell execution and package management represents a significant attack surface and meets the threshold for a suspicious classification despite no clear evidence of intentional malice.