Sarvam AI

Use Sarvam AI for Indian language Text-to-Speech (TTS), Speech-to-Text (STT), Translation, and Chat.

This skill appears coherent and limited to the Sarvam AI service, but review and consider the following before installing: 1) The script will send text/audio to https://api.sarvam.ai — only provide an API key you trust and do not reuse highly privileged keys. 2) The SKILL.md suggests storing SARVAM_API_KEY in a .env in the workspace; ensure workspace env files are not shared or committed to source control. 3) validate_filename prevents absolute paths and '..' but still allows relative paths (subdirectories) — be careful what file paths you pass to avoid accidental disclosure of sensitive local files. 4) The required binary path is Windows-specific (\.venv\Scripts\python.exe) while examples include Unix paths; confirm the expected virtualenv layout before running. 5) Because there is no install step, the included script will be executed directly — you already reviewed it, but if you did not, inspect the script and verify the network endpoints and behavior before use. If you want to be more cautious, run the CLI in an isolated environment or with a scoped API key you can rotate.

Type: OpenClaw Skill Name: sarvam Version: 1.0.1 The skill is benign, providing access to Sarvam AI services for TTS, STT, Translation, and Chat as described. The `scripts/sarvam_cli.py` file correctly uses the `SARVAM_API_KEY` for authentication to the intended `api.sarvam.ai` endpoint. It includes a `validate_filename` function to prevent path traversal and absolute paths when handling file inputs/outputs, demonstrating an effort to mitigate file system vulnerabilities. There is no evidence of data exfiltration to unauthorized domains, arbitrary command execution, persistence mechanisms, or prompt injection attempts in `SKILL.md`.