Ressemble TTS e STT

Text-to-Speech and Speech-to-Text integration using Resemble AI HTTP API.

What to consider before installing: - The skill will send audio and text to Resemble's endpoints and requires your RESEMBLE_API_KEY (the scripts check for it). Do not provide a production key until you review and trust the scripts. - Registry metadata currently omits the RESEMBLE_API_KEY and required binaries (curl, jq, base64). This is likely an oversight but should be corrected — ask the publisher to declare required env vars/binaries in the registry entry. - Review the two shell scripts yourself (they are small): they post to https://app.resemble.ai and https://f.cluster.resemble.ai, poll job status, and write synthesized MP3s to /tmp. Confirm these endpoints are the official Resemble domains you expect. - Be aware that transcripts and audio are uploaded to a third-party service. If you handle sensitive audio, consider using a throwaway or limited-scope API key for testing and rotate the key after exposure. - If you want higher assurance, ask the author to (a) fix the registry metadata to list RESEMBLE_API_KEY and required binaries, (b) provide provenance or homepage, and (c) explain why two different Resemble hosts are used for TTS vs STT. Additional information that would change this assessment: explicit registry metadata declaring the env var and binaries (would raise confidence to benign), or discovery of additional undeclared credentials/endpoints (would raise severity).

Type: OpenClaw Skill Name: ressemble Version: 1.0.1 The skill bundle is classified as suspicious due to vulnerabilities in input handling within the shell scripts. Specifically, `scripts/tts.sh` directly interpolates user-provided text and voice UUID into a JSON payload, creating a JSON injection vulnerability if the input contains special characters. Similarly, `scripts/stt.sh` uses the user-provided audio file path directly without explicit sanitization, which could lead to issues if the path contains shell metacharacters. While these are vulnerabilities and not evidence of malicious intent, they represent a risk of unexpected behavior or potential exploitation if the agent provides crafted inputs. The scripts otherwise interact with legitimate Resemble AI API endpoints (`https://app.resemble.ai`, `https://f.cluster.resemble.ai`) for their stated purpose.