tts-winmsg-free

Windows本地TTS朗读技能。通过WM_COPYDATA消息把AI回复实时发送到迷你窗口朗读，支持中英文标点分割、队列顺序播放、语速音量滑块调节，零token消耗，完全本地运行。

This skill appears to do what it says: run a small local TTS window and send your AI's visible replies to it. Before installing/running, consider: (1) it requires Windows, Python, and pywin32; you must start the wmserver script once and the agent will run sendmsg_hwnd.py for each visible reply (so anything you see in the chat will also be spoken aloud). (2) The scripts read/write config/wmserver_hwnd.txt — if that file is maliciously changed to an arbitrary HWND, the sender could forward text to another process; keep the config directory trusted. (3) The code runs PowerShell to speak text locally (no network calls or credential access). If you obtained the skill from an untrusted source, review the scripts yourself or run them in an isolated account before use.

Type: OpenClaw Skill Name: tts-winmsg-free Version: 1.0.0 The skill provides local Text-to-Speech (TTS) functionality by invoking PowerShell's SpeechSynthesizer via subprocess calls. It is classified as suspicious because it is vulnerable to shell injection in `scripts/wmserver_20260327.py` and `scripts/test_window.py`; the sanitization logic (replacing single quotes with double single quotes) is insufficient to prevent an attacker or a manipulated AI from escaping the PowerShell string context to execute arbitrary commands. Additionally, the use of Base64 encoding for PowerShell execution (`-EncodedCommand`) and the direct execution of system commands based on AI-generated content represent a high-risk pattern, even though the stated intent is benign.