Togetherai Tts

Convert text to speech using the TogetherAI API with the MiniMax speech-2.6-turbo model and save audio in mp3 format.

This skill appears to implement the described TTS function, but the registry metadata failed to list the required TogetherAI API key (TOGETHERAI_API_KEY). Before installing: 1) Confirm you trust the skill author and verify the package source; 2) Don't provide unrelated or high-privilege secrets — only supply a TogetherAI API key in a scoped environment; 3) Consider running the skill in a sandbox or container and inspect network activity to ensure it's only calling api.together.ai; 4) Prefer to install only if the registry metadata is corrected (primary credential declared) or after you manually review the code (index.js is short and readable). If you cannot verify the publisher or prefer tighter controls, do not install or run with real credentials.

Type: OpenClaw Skill Name: togetherai-tts Version: 1.0.1 The skill's primary function is legitimate text-to-speech generation using the TogetherAI API. However, the `index.js` script directly uses `process.argv[3]` as the `outputFile` for `fs.writeFileSync` without any input sanitization. This creates an arbitrary file write vulnerability, allowing a malicious agent or user to specify a path traversal sequence (e.g., `../../../../tmp/malicious.sh`) and write files to arbitrary locations on the system, which could lead to remote code execution or other system compromise. This is a critical vulnerability, classifying the skill as suspicious.