voice-output

Use when Tony says voice reply or asks to speak. Speaks the response aloud via Doubao TTS to MOMAX BS6.

This skill looks like a legitimate TTS helper but has a few issues you should consider before installing: - Hard-coded credential: The script contains an ACCESS_TOKEN string and APPID embedded in source. That token could be abused by whoever has it, may consume someone else's quota, or may be invalid. Ask the author to remove embedded secrets and require the user to provide their own token (e.g., via an environment variable) before use. If you install it, treat the embedded token as untrusted and consider rotating your own service credentials if you test it. - Data sent to external service: All text passed to this skill is transmitted to Doubao/ByteDance's TTS endpoint. Do not send sensitive, private, or regulated data through this skill unless you control the service account and have reviewed privacy/compliance. - Path and OS assumptions: SKILL.md uses an absolute user path (/Users/tony/...) and the code uses macOS 'afplay'. If you are not on macOS or your skill workspace is elsewhere, update the invocation instructions and the player command. - Recommended actions before installing: (1) Request that the maintainer replace the hard-coded ACCESS_TOKEN with a requirement to set an env var (and update SKILL.md). (2) Verify who owns the embedded token (if you must use it temporarily) and whether it should be rotated. (3) Run the script in a sandbox or isolated account first and confirm it only sends the expected TTS requests and deletes temp files. (4) If you need cross-platform playback, update the code to detect the OS and choose an appropriate player. If the maintainer cannot or will not remove the embedded token and document how credentials are set, treat this package as risky and prefer a version that requires user-supplied credentials.

Type: OpenClaw Skill Name: voice-output Version: 1.0.1 The skill provides text-to-speech functionality by integrating with the Doubao (ByteDance) TTS API and using the macOS 'afplay' utility for audio playback. The implementation in 'voice_speak.py' is functionally sound, employing a PID-based lock file to prevent overlapping audio and safely handling subprocess calls without shell execution. While the bundle contains hardcoded API credentials (APPID and ACCESS_TOKEN) and a user-specific directory path in 'SKILL.md', these appear to be artifacts of a local development environment rather than intentional vulnerabilities or malicious features. The data flow is restricted to the stated purpose of converting text to audio via a legitimate third-party service.