SiliconFlow TTS Gen

Text-to-Speech using SiliconFlow API (CosyVoice2). Supports multiple voices, languages, and dialects.

This skill appears to do what it says: convert text to speech via the SiliconFlow API. Before installing, (1) verify the SiliconFlow domain (api.siliconflow.cn) and that you trust the service and its API key handling; (2) inspect ~/.openclaw/openclaw.json for other stored credentials before allowing the skill to read it, or set SILICONFLOW_API_KEY in the environment instead; (3) consider providing a scoped API key (least privilege) and monitor network use if you are concerned. Note the small manifest inconsistency about whether an env var is required—prefer the SKILL.md / skill.json guidance (SILICONFLOW_API_KEY required).

Type: OpenClaw Skill Name: siliconflow-tts-gen Version: 1.0.0 The skill is classified as suspicious due to a local file write vulnerability in `scripts/generate.py`. The `--output` argument, which specifies the path for the generated audio file, is passed directly to `curl -o` without sanitization. This allows a user to specify an arbitrary file path, potentially leading to directory traversal or overwriting sensitive user-owned files (e.g., `~/.bashrc`, `~/.ssh/authorized_keys`) with audio data, limited by user permissions. While the content written is an audio file, this uncontrolled file write capability is a significant vulnerability, even without clear malicious intent for self-exploitation. The skill correctly handles API keys and uses `subprocess.run` with a list of arguments, mitigating shell injection risks for other parameters.