Windows TTS (WSL2)

在 Windows 11 上"直接发声"的 TTS（从 WSL2/TUI 调用 powershell.exe + System.Speech）。适用于用户说"说出来/读出来/语音播报/用TTS"，或反馈"没声音/tts 生成的 mp3 是空的/播不出来"，以及需要中文语音但 OpenClaw 内置 tts 不可用时。

This skill is coherent and will play speech through Windows as advertised, but it currently treats the text you ask it to speak as a PowerShell double‑quoted string and does not neutralize PowerShell variable or subexpression syntax. That means a crafted message (e.g., containing $env:..., $(...), etc.) could cause PowerShell to evaluate code on your Windows host. Before installing/use: (1) Only run this skill in trusted environments and avoid feeding untrusted text to it. (2) Prefer a patched version of say.sh that safely passes the text to PowerShell (for example: use single-quoted here-strings or -EncodedCommand, or otherwise escape/encode $ and $( ) so no interpolation happens). (3) If you want to proceed comfortably, ask the maintainer to fix the script to treat text as a literal string (e.g., use $s.Speak(@'... '@) or use powershell -EncodedCommand with base64), and add an explicit OS requirement for WSL/Windows in the metadata.

Type: OpenClaw Skill Name: windows-tts-wsl2 Version: 1.1.1 The skill bundle is classified as suspicious due to a critical shell injection vulnerability in `scripts/say.sh`. The script constructs a PowerShell command using user-provided input for `--voice`, `--rate`, `--volume`, and the main text, but the input sanitization (using `sed 's/"/`"/g'`) is insufficient. This allows an attacker to inject arbitrary PowerShell commands by including characters like semicolons (`;`) in the input, potentially leading to remote code execution on the Windows host via WSL2.