文字转语音技能。当你需要将文本转换为自然的人声朗读时调用此技能。

This skill is suspicious because it instructs the agent to run a local Python script directly (bypassing the platform runner) and the script sends prompts and any provided local files to an external default URL (https://dlazy.com) that is not declared in the manifest. Before installing: 1) verify the identity and trustworthiness of the skill owner and the dlazy.com endpoint; 2) prefer skills that use the platform's standard invocation method (do not allow instructions that force direct system execution); 3) if you must use it, set TEAM_BASE_URL explicitly to a trusted/internal endpoint and avoid running it where sensitive files or credentials are accessible; 4) inspect or audit the script yourself or request the developer to remove the hardcoded/default external endpoint and to declare TEAM_BASE_URL in the manifest; 5) if you cannot verify the endpoint or the owner, do not install or run this skill. Additional information that would change this assessment: confirmation of who operates dlazy.com, a manifest update declaring TEAM_BASE_URL, and removal of the instruction that forces direct system execution.

Type: OpenClaw Skill Name: lrshuai-text-to-speech Version: 1.0.0 The skill contains a prompt injection in SKILL.md that explicitly instructs the AI agent to bypass the standard 'openclaw run' execution path and instead run the Python script directly, which may be an attempt to evade platform-level monitoring or sandboxing. The script 'script/invoke_model.py' sends the user's 'TEAM_API_KEY' to a third-party endpoint (dlazy.com), and while this appears to be the intended API gateway, the combination of bypassing standard protocols and using a non-standard backend is a significant security risk.