中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：1 天前 重新扫描
15 /100
free-tts-voice-cloning
免费文字转语音与克隆 - 完全免费的本地TTS和声音克隆技能
Legitimate local TTS and voice cloning skill with no malicious behavior detected. The skill performs exactly as documented with minor issues (remote script download for Homebrew installation, version unpinned dependencies) that are standard practices for tool installation scripts.
技能名称free-tts-voice-cloning
分析耗时35.4s
引擎pi
✓
可以安装
This skill is safe to use. The curl|bash pattern in install_dependencies.sh downloads Homebrew from the official GitHub repository, which is a standard and widely-accepted practice. Users should ensure they review installation scripts before execution as a general security practice.

安全发现 2 项

严重性 安全发现 位置
低危
Unpinned Python dependency version 供应链
The install_dependencies.sh script installs mlx-audio without version pinning. This could lead to unexpected behavior if the package changes in the future.
python3.10 -m pip install mlx-audio
→ Consider pinning the version: pip install mlx-audio==x.x.x to ensure reproducible builds
 install_dependencies.sh:14
提示
Initial model download from HuggingFace 文档欺骗
SKILL.md states '无需联网' (no internet required) but the model is downloaded from HuggingFace on first run. This is a minor documentation inaccuracy - the skill processes data locally after initial download.
model = load_model('mlx-community/Qwen3-TTS-12Hz-1.7B-Base-8bit')
→ Update SKILL.md to clarify: '首次运行需联网下载模型（约3GB），之后完全本地运行'
 voice_cloning_demo.py:47
资源类型声明权限推断权限状态证据
文件系统 WRITE WRITE ✓ 一致 voice_cloning_demo.py writes audio output files via open() with 'wb' mode
网络访问 READ READ ✓ 一致 load_model() downloads MLX model from HuggingFace on first run - declared in SKI…
命令执行 WRITE WRITE ✓ 一致 install_dependencies.sh executes brew install and pip install - declared in SKIL…
环境变量 NONE NONE — No environment variable access found in code
技能调用 NONE NONE — No inter-skill invocation found
剪贴板 NONE NONE — No clipboard access found
浏览器 NONE NONE — No browser access found
数据库 NONE NONE — No database access found
3 项发现
🔗
中危 外部 URL 外部 URL
http://127.0.0.1:18789/
README.md:25
🔗
中危 外部 URL 外部 URL
https://hf-mirror.com
SKILL.md:239
🔗
中危 外部 URL 外部 URL
https://docs.openclaw.ai/skills/voice-cloning
package.json:19

目录结构

6 文件 · 19.3 KB · 645 行
Markdown 2f · 446L Python 1f · 133L JSON 2f · 36L Shell 1f · 30L
├─ 📋 _meta.json JSON 11L · 575 B
├─ 🔧 install_dependencies.sh Shell 30L · 679 B
├─ 📋 package.json JSON 25L · 958 B
├─ 📝 README.md Markdown 119L · 3.0 KB
├─ 📝 SKILL.md Markdown 327L · 10.3 KB
└─ 🐍 voice_cloning_demo.py Python 133L · 3.8 KB

依赖分析 3 项

包名版本来源已知漏洞备注
mlx-audio * pip 否 Version not pinned in install script
ffmpeg latest homebrew 否 Installed via Homebrew
[email protected] latest homebrew 否 Standard Python installation

安全亮点

✓ No credential harvesting or API key theft detected
✓ No data exfiltration to external servers during TTS processing
✓ No obfuscated code (base64, eval, etc.) found
✓ No reverse shell or C2 communication patterns
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ No hidden functionality different from documentation
✓ Legitimate use of subprocess for tool installation (Homebrew, pip)
✓ Clear and comprehensive legal/ethics disclaimer included
✓ Local-only processing claim aligns with code implementation (MLX framework)