Telegram Offline Voice

本地生成 Telegram 语音消息，支持自动清洗、分段与临时文件管理。

This skill is mostly coherent: it converts text to OGG via edge_tts and ffmpeg and manages temp files correctly. However, the author repeatedly claims "100% local / zero token" while importing and using edge_tts — that library typically obtains TTS audio from Microsoft services (network calls), so the skill may not be truly offline. Before installing or running: 1) Verify edge_tts behavior in your environment (check its docs or run it in a sandbox) to confirm whether audio is generated locally or fetched from the network. 2) If you require strict offline operation, consider replacing edge_tts with a known local TTS engine (Coqui/tts, local OpenTTS endpoint, or local Edge browser invocation) or explicitly audit network traffic. 3) Avoid running curl | sh blindly — the uv install script is optional; prefer installing known packages from distro repos or inspecting the installer first. 4) Run the script in an isolated environment first (container or VM), monitor outbound connections (tcpdump/strace) and review installed Python dependencies (pip show edge-tts) to ensure no unexpected exfiltration. If you cannot confirm edge_tts is purely local, treat the offline claim as inaccurate and proceed with caution.

Type: OpenClaw Skill Name: telegram-offline-voice Version: 0.1.3 The skill is classified as suspicious due to the use of `curl -LsSf https://astral.sh/uv/install.sh | sh` in both `SKILL.md` and `README.md` for installing the `uv` dependency. While `uv` is a legitimate tool and its installation is plausible for the skill's stated purpose, this method of executing remote code directly from the internet is a high-risk practice that bypasses integrity checks and introduces a supply chain vulnerability. The core Python script (`scripts/voice_gen.py`) itself appears benign, performing its stated function of text-to-speech and audio conversion using `ffmpeg` without evidence of malicious intent.