Qwen3 Audio

High-performance audio library for Apple Silicon with text-to-speech (TTS) and speech-to-text (STT).

This skill appears to do what it claims (local TTS/STT using the mlx-audio package), but it will: (1) install a third‑party Python package at runtime via the 'uv' tool; (2) access network endpoints to check/download model data (Hugging Face or a mirror) and reference an external test audio URL; and (3) read/write audio/text files (including creating a voices/ folder and temp chunk files). Before installing/using: review the mlx-audio package and its reputation; run the skill in an isolated environment (VM or container) if you want to limit blast radius; confirm whether model inference happens locally or via remote inference (if remote, audio might be transmitted to external servers); and inspect or vet any models you download for license/privacy implications. Because the skill's source/homepage is unknown, exercise extra caution and avoid providing sensitive audio unless you are confident about where processing occurs.

Type: OpenClaw Skill Name: qwen3-audio Version: 0.1.1 The skill is suspicious due to several vulnerabilities in `scripts/mlx-audio.py`. It allows arbitrary file read/write operations via user-controlled paths (`--output`, `--audio`, `--ref_audio`) in the `run_tts` and `run_stt` functions. Additionally, the `run_stt` function directly embeds the `--ass-style` argument into the ASS subtitle file header without sanitization, creating a clear injection vulnerability. While these are significant flaws that could be exploited by a malicious agent prompt or user, the code does not exhibit clear evidence of intentional malicious behavior such as data exfiltration or backdoor installation.