Qwen3 TTS Instruct

Alibaba Cloud Bailian Qwen TTS with voice/mood presets

This skill appears to be a genuine TTS client, but there are a few red flags you should consider before installing: - Manifest mismatch: the platform metadata claims no required env vars, but SKILL.md and setup.sh require DASHSCOPE_API_KEY. Treat that as a sign to be cautious — the skill will need a secret. - Audit the code (scripts/tts.py) before exporting any API key. Look specifically for any subprocess.run or os.system calls that use unescaped user input (command-injection risk) and verify all network endpoints are only DashScope/Aliyun hosts. - Limit the API key's permissions and rotate it after testing; do not reuse high-privilege or long-lived credentials. - Note the instruction to ‘always call’ this skill: installing it may change agent behavior if you allow autonomous invocation. If you do not want every voice response routed through an external service, keep autonomous invocation disabled or decline to follow the 'always call' guideline. If you want a higher-confidence verdict provide the full, untruncated scripts/tts.py content (so we can inspect any subprocess calls and all network endpoints) and confirm whether the registry metadata can be corrected to declare DASHSCOPE_API_KEY explicitly.

Type: OpenClaw Skill Name: qwen3-tts-instruct Version: 1.0.0 The OpenClaw AgentSkills skill bundle for Qwen TTS is classified as benign. The `SKILL.md` provides detailed instructions for the AI agent on how to use the TTS skill effectively, focusing on mood selection and language translation, which are legitimate functional requirements and not malicious prompt injection attempts. The `scripts/setup.sh` performs standard dependency checks (ffmpeg, curl) and installs Python packages (`dashscope`, `websocket-client`, `soundfile`) into a virtual environment. The `scripts/tts.py` script interacts with the Alibaba Cloud DashScope TTS API, processes arguments, and includes a `validate_language` function as a guardrail to ensure correct language usage. There is no evidence of data exfiltration, malicious execution (despite `subprocess` being imported, it is not used), persistence, or obfuscation.