TTS AutoPlay with Wake Word

Auto-play TTS voice files with wake word detection. Only plays audio when user message contains wake words like "语音", "念出来", "voice", etc. Perfect for Webcha...

Do not run the 'powershell -ExecutionPolicy Bypass -File ...' commands until you obtain and review the actual .ps1 scripts. Steps to take before installing: - Verify source: visit the GitHub homepage linked in the SKILL.md and ensure the repo is the official one and contains the expected scripts. - Inspect scripts: open install.ps1, tts-autoplay-wakeword.ps1, uninstall.ps1 and any files they call. Look for network calls, encoded/obfuscated code, or commands that upload data or modify system-wide settings. - Check data access: confirm exactly which files/logs the scripts read (openclaw.json, chat logs, C:\tmp\openclaw) and whether that level of access is acceptable for your environment. - Avoid blind execution: do not run scripts with ExecutionPolicy Bypass unless you trust and have reviewed them. Run them in a sandboxed/testing machine first. - Prefer the 'tagged' approach: the docs recommend using auto: "tagged" and having the model add [[tts]] tags (simpler, avoids session-history monitoring). Consider implementing wake-word logic inside the AI skill (add [[tts]] on wake words) rather than running a persistent process that reads chat logs. What would change this assessment: provide the actual PowerShell script sources (install.ps1, tts-autoplay-wakeword.ps1, tts-autoplay.ps1). If those scripts are small, local, transparent (no network/exfiltration), and only read the declared TTS dirs and openclaw.json, the rating could be upgraded to benign.

Type: OpenClaw Skill Name: tts-autoplay Version: 2.0.1 The skill's documentation (SKILL.md, README.md) instructs users to execute PowerShell scripts (e.g., install.ps1, tts-autoplay-wakeword.ps1) using `powershell -ExecutionPolicy Bypass`. While this is a common practice for running local, unsigned scripts, it bypasses a security feature and represents a significant vulnerability risk if the underlying scripts were malicious. The actual PowerShell script files were not provided for analysis, preventing a full assessment of their intent. However, the instruction to bypass execution policy itself is a risky capability, leading to a 'suspicious' classification.