火山引擎豆包语音播客

生成火山引擎豆包语音播客（PodcastTTS）。输入主题文本，自动生成双人对话式播客音频。

What to consider before installing/using this skill: - Credentials: The code requires a Volcengine appid and access token (SKILL.md references VOLC_APPID and VOLC_ACCESS_TOKEN). The registry metadata does not list these — assume you must provide them. Only supply keys you control and are comfortable using for TTS calls. - Hidden config access: scripts/kamei_podcast.py will try to read ~/.openclaw/config.json for credentials. Inspect that file (if present) before running to ensure it doesn't contain unrelated secrets you don't want read by this code. - File writes & permissions: kamei_podcast.py copies generated audio to /root/.openclaw/media/qqbot/downloads (SEND_DIR). That path requires root permissions and is not documented in SKILL.md. If you run as a non-root user the copy will fail; if you run as root the skill will write into that location. Consider changing SEND_DIR or running in a sandbox/container and inspect the script before use. - Hardcoded key: an app_key default (aGjiRDfUWi) is embedded in the code. Confirm whether you should use your own key rather than the default, and avoid relying on embedded/unknown keys. - Network endpoint: the client connects to wss://openspeech.bytedance.com/api/v3/sami/podcasttts. If you require assurance about what is sent, review the code path that builds headers and payload (headers include your appid/access_key) and consider running it in an environment where you can monitor outbound connections. - Safety steps: review the files (generate_podcast.py and kamei_podcast.py) locally before running, provide only least-privilege credentials, and run the skill in a sandbox or non-root account. If you want to use it in an automated agent, update SEND_DIR to a safe location and remove or verify any reading of ~/.openclaw/config.json. If source/origin is important, ask the publisher for provenance (homepage, contact) because 'Source: unknown' increases risk. If you can provide the publisher/source or confirm the intended runtime environment (e.g., OpenClaw agent running as root in a container), I can re-evaluate and raise or lower the confidence accordingly.

Type: OpenClaw Skill Name: volcano-engine-podcast Version: 1.1.1 The skill bundle is a legitimate implementation for generating AI-powered dual-speaker podcasts using the Volcengine (ByteDance) PodcastTTS API. It includes a robust implementation of a custom binary WebSocket protocol in `protocols.py` and a well-structured generator in `generate_podcast.py`. The integration script `kamei_podcast.py` correctly handles configuration by reading from the standard OpenClaw path (`~/.openclaw/config.json`) and outputs files to a designated media directory for bot delivery. No evidence of data exfiltration, malicious execution, or prompt injection was found.