Multimodal Base

Supports image understanding, OCR, speech-to-text, and text-to-speech synthesis with multi-voice and multimodal unified processing using OpenAI and Edge TTS.

This skill largely does what it says (image understanding, OCR, STT and TTS), but there are several red flags you should consider before installing: - It requires an OpenAI API key (used by multiple modules) even though the registry metadata lists no required env vars — confirm you are willing to provide that key. Limit the key's scope if possible. - The README asks you to pip install the Python 'edge-tts' CLI, but package.json also lists an npm 'edge-tts' package — clarify which implementation is intended. The code spawns a system 'edge-tts' command, so you must install the Python CLI or otherwise provide that executable. - The speech recognizer can run locally and will attempt to download a Whisper model from Hugging Face and save it to disk. Downloading and executing third-party binaries has risk — review the model URL and consider running in a sandbox or verifying checksums. - The code spawns external executables ('whisper' / whisper.cpp, 'edge-tts', 'ffprobe') and writes output/temp files. Ensure you trust the package source and run it in an environment where those binaries and filesystem writes are acceptable. - If you want to proceed: ask the author to (1) update registry metadata to declare required env vars (OPENAI_API_KEY), (2) clarify install steps (npm vs pip edge-tts), and (3) document where the Whisper model is stored and whether checksums/verifications are provided. Otherwise run the skill in an isolated container or VM and avoid giving it high-privilege credentials.

Type: OpenClaw Skill Name: yuyonghao-multimodal-base Version: 0.1.0 The skill bundle provides a standard multimodal integration for image processing (GPT-4o/Tesseract), speech recognition (Whisper), and text-to-speech (Edge-TTS). The code uses legitimate APIs and follows standard patterns for handling external binaries via `child_process.spawn` with argument arrays, which mitigates basic shell injection risks. No evidence of data exfiltration, malicious persistence, or prompt injection was found across the source files (src/image-processor.js, src/speech-recognizer.js, etc.).