tencent-tts-podcast

Convert text to podcast audio using Tencent Cloud TTS. Supports both short and long text processing, generates up to 30-minute long audio with automatic chun...

What to check before installing/running: - Expect to provide Tencent Cloud SecretId and SecretKey (or set environment variables TENCENT_TTS_SECRET_ID/TENCENT_TTS_SECRET_KEY). The registry metadata did not list these — confirm where you will supply them. - Review the code yourself (tts_podcast.py and tts_tool.py) before supplying credentials. tts_tool will try to import core.tts_config.get_tts_credentials if available; if your agent/runtime has a core module it may return platform-level secrets. If you don't want that, remove/override that import or ensure the core module won't expose secrets. - If enabling COS upload, check the default bucket_name ('ti-aoi') and app_id (1257195185). By default upload is disabled, but if enabled and you leave defaults, files might be uploaded to someone else's COS account. Prefer supplying your own COS credentials and bucket. - Run with least-privilege credentials: create an API key limited to TTS (and COS only if you enable upload) rather than using broad account keys. - The skill produces WAV files only (no MP3), and dependencies listed are standard (tencentcloud-sdk-python, cos-python-sdk-v5, requests). Install dependencies in a virtualenv or sandbox. - If you want higher assurance, ask the skill author to remove the implicit core.tts_config import or to document when/why it will access platform secrets and to update registry metadata to list required env vars.

Type: OpenClaw Skill Name: tencent-tts-podcast Version: 1.0.0 The skill bundle is functional for its stated purpose but contains high-risk configurations and behaviors. Specifically, 'tts_podcast.py' includes a hardcoded default Tencent Cloud AppID (1257195185) and Bucket Name ('ti-aoi'), which could lead to users unintentionally uploading audio data to the developer's infrastructure if they do not provide their own COS credentials. Additionally, the script includes a runtime dependency installer that uses 'subprocess.check_call' to execute 'pip install' for the 'cos-python-sdk-v5' library, which is a risky execution pattern even if intended for convenience.