purevocals-uvr-automator

当用户想要**一键批量从音频文件中提取超干净纯人声（干声 / Vocals Only）**、去除伴奏/背景音乐时，自动调用此技能。 一键音频人声分离工具。专门从音频文件（.mp3/.wav/.flac等）中提取超干净干声（Acapella）或去除背景音制作伴奏。 核心用途：支持单个音频文件或整个文件夹批量处理（....

What to consider before installing/using this skill: - Legitimate purpose but surprising side effects: the code does implement vocal extraction, GPU detection and model downloads, but it also runs pip at runtime and (on import) force-reinstalls setuptools/wheel in the current Python, which can modify your system or other projects unexpectedly. - Network downloads & large files: it will download ffmpeg and ML models (hundreds of MB to GB) from external URLs and PyTorch wheels from pytorch.org. Expect big network/ disk usage and possible firewalls/slowdowns. - Persistent artifacts: models/, logs/, and a venv directory (VENV_DIR) are created on disk. VENV_DIR appears to be outside the skill folder and may be shared — check its path before running. - Privileged operations: the script invokes subprocesses (pip, nvidia-smi, ffmpeg-downloader, audio-separator CLI) and may run long installs and re-launch itself inside a created venv. Practical recommendations: - If you want to try it, run it first in a sandboxed environment: a disposable VM, container, or an isolated user account where side effects are acceptable. - Inspect and/or modify the code before running: move the setuptools fix/any pip installs into an explicit, documented setup step (not at module import), or require user confirmation before modifying the global Python environment. - Prefer manual venv: change VENV_DIR to a skill-local venv (inside the skill folder) or let the user supply the venv path. Verify that package installs occur inside that venv, not the global interpreter. - Monitor network and disk: be ready for large downloads and ensure you have sufficient storage and bandwidth. Consider pre-downloading models to models/ and set offline usage. - If you need higher assurance: ask the author for a version that avoids global pip calls at import time and documents all external downloads and paths it will write to. Confidence note: medium — the code clearly performs the operations described, but some behaviors (top-level pip/setuptools change, shared venv location) may be legitimate design choices for convenience; they are nonetheless risky and under-documented.

Type: OpenClaw Skill Name: purevocals-uvr-automator Version: 1.0.5 The skill automates audio vocal separation by managing a complex environment, including automatic virtual environment creation, GPU detection, and the installation of heavy dependencies like PyTorch and audio-separator. It performs high-risk operations such as force-reinstalling specific versions of 'setuptools', downloading 'ffmpeg' binaries via 'ffmpeg-downloader', and fetching AI models from GitHub (TRvlvr/model_repo). While these actions are aligned with the stated purpose of providing a 'one-click' solution, the automated execution of third-party installers and binary downloads via 'subprocess' in scripts/env_manager.py and scripts/purevocals.py constitutes a significant attack surface without evidence of intentional malice.