Minimax Tts Cn

MiniMax TTS skill (enhanced). Multi-agent voice support (each agent can select a unique voice written in SOUL.md), native voice message for Telegram (MP3) an...

This skill appears to do what it claims: call MiniMax's API to produce audio and optionally send it to Telegram or prepare Feishu-compatible files. Before installing, consider the following: - MINIMAX_API_KEY is required and will be used to authenticate to https://api.minimaxi.com — only provide a key you trust to be used for TTS. Do not reuse high-privilege keys elsewhere. - Telegram credentials (TELEGRAM_BOT_TOKEN, TELEGRAM_TARGET) are only needed if you want the skill to send messages. If you do not want automatic sending, leave them unset; the skill supports a --generate-only mode. - The registry metadata marks Telegram vars as required although the SKILL.md and scripts treat them as optional — treat the SKILL.md behavior as authoritative and verify before supplying Telegram tokens. - The scripts load a .env file and export its entries into the environment. Keep .env private and out of version control (setup.txt already warns about this). - The python script and shell wrapper use workspace paths (~/.openclaw/workspace). Check those directories for generated files and remove audio files if you do not want them retained. If you need higher assurance, you can inspect/verify the two included files (scripts/tts.py and scripts/tts-xiaoye.sh) locally before supplying secrets. If you do not intend to send to Telegram/Feishu, omit the related env vars to reduce blast radius.

Type: OpenClaw Skill Name: minimax-tts-plus Version: 1.2.3 The skill provides legitimate Text-to-Speech functionality using the MiniMax API and supports delivery to Telegram and Feishu. However, it is classified as suspicious due to a potential file exfiltration vulnerability in `scripts/tts-xiaoye.sh`. The script passes the `CAPTION` and `TARGET` variables directly to `curl -F` without sanitization; if these variables are manipulated (e.g., via prompt injection) to start with the `@` character, `curl` will attempt to read and upload local files such as the `.env` file (containing API keys) or SSH keys. While the behavior aligns with the stated purpose, this lack of input validation in a shell script that performs network requests poses a significant security risk.