qwencloud-audio-tts

[QwenCloud] Synthesize speech from text with Qwen TTS models. TRIGGER when: user wants to convert text to speech, create voiceovers, generate audio narration...

What to consider before installing: - The skill needs your Qwen/DashScope API key (DASHSCOPE_API_KEY or QWEN_API_KEY) to function, but the registry metadata incorrectly states 'none'. Do not paste your API key into chat — set it as an environment variable or in a local .env file and keep the key private. - The bundled scripts read .env and search your repository for config/skill files and may write small files (audio outputs, response.json, and .agents/state.json). If you install this in a sensitive repo, review the code first or run it in an isolated environment. - The code may run local subprocesses (used for update-checks) and can execute other local scripts if present; verify those scripts before allowing operations that run them. - If you trust the source and want to use the skill: (1) inspect scripts/qwencloud_lib.py, scripts/tts.py and scripts/tts_cosyvoice.py to confirm they match your expectations; (2) provide the API key via environment or .env (not via chat); (3) consider running the scripts in a dedicated virtualenv or sandbox to avoid accidental exposure of repo secrets. - If you do not trust the origin or cannot verify the code, do not install. At minimum request that the publisher update the registry metadata to list the required env vars and primary credential so it accurately reflects the skill's needs.

Type: OpenClaw Skill Name: qwencloud-audio-tts Version: 0.2.0 The skill provides legitimate text-to-speech functionality using QwenCloud APIs via HTTP and WebSocket. It includes a robust shared library (qwencloud_lib.py) for API interaction, environment management, and optional file uploads to Alibaba Cloud OSS. While it contains an update-check mechanism (gossamer.py) that uses subprocess calls and npx to manage skill installations, these behaviors are transparently documented in SKILL.md and designed to be executed only with user consent. The code follows security best practices by explicitly instructing the agent to mask API keys and avoid plaintext exposure.