Voice.ai Voices

High-quality voice synthesis with 9 personas, 11 languages, and streaming using Voice.ai API.

This skill appears internally consistent: it bundles a Node.js CLI/SDK that uses a single VOICE_AI_API_KEY to call the declared HTTPS API and writes audio output locally. Before installing, verify the vendor/source (check the GitHub repo URL in package.json), confirm that https://dev.voice.ai is the correct production endpoint for your use, and treat your VOICE_AI_API_KEY like any secret (store securely, use least-privilege keys if available, and rotate the key if you suspect leakage). If you want extra assurance, inspect or run the CLI in an isolated environment and monitor outbound network requests to confirm they go only to the expected domain.

Type: OpenClaw Skill Name: voice-ai-voices Version: 1.1.5 The skill is generally well-documented and transparent, explicitly stating its network and file access behaviors. However, the `scripts/tts.js` file directly uses the user-provided `--output` argument for `fs.writeFileSync` and `fs.createWriteStream` without path sanitization. This introduces a path traversal vulnerability, allowing an attacker to write generated audio to arbitrary file paths (e.g., `../../../../etc/passwd`), potentially leading to data corruption or denial-of-service, which is a risky capability without clear malicious intent.