Web Reader TTS

提取网页正文，自动检测语言，使用微软Edge TTS合成语音并通过Whisper识别，支持中英日及混合语言朗读。

This skill appears to be what it says: it fetches pages, extracts text, synthesizes audio via Microsoft Edge TTS, and transcribes with Whisper. Before installing, consider: (1) Privacy: synthesized text is sent to Microsoft’s Edge TTS service (no API key required), so avoid sending highly sensitive content you don't want transmitted off-device. (2) Resource use: Playwright will download Chromium and Whisper may download very large models (medium/large), so ensure you have bandwidth and disk space. (3) Untrusted pages: the skill will load and render arbitrary URLs in a headless browser — do not point it at internal URLs or pages containing secrets. (4) The repo includes a transcript.txt containing many offensive/malicious command examples — this is likely sample data but underscores that the skill will faithfully read whatever text it extracts. If you need stricter privacy, consider an offline/local TTS engine or review/clean content before sending it to Edge TTS.

Type: OpenClaw Skill Name: web-reader-tts Version: 2.0.0 The skill bundle provides a functional web-to-speech tool but includes a highly suspicious 'transcript.txt' file that contains an extensive collection of offensive security commands. This file includes instructions for credential dumping (Mimikatz, secretsdump), persistence (enabling the guest account), registry manipulation (wdigest), and remote exploitation (MS17-010, xp_cmdshell). While the Python script (web_reader_tts.py) and the instructions (SKILL.md) do not directly execute these commands, the presence of a 'Pentest Cheat Sheet' within a sample transcript file suggests a potential prompt-injection payload or an attempt to smuggle malicious instructions into the agent's context. The use of Playwright to fetch arbitrary web content further increases the risk that the agent might encounter and act upon similar malicious strings from external URLs.