Skill: zhaov1976/voice-edge-tts (version 1.10.0)

# Voice Skill (Edge TTS) Text-to-speech skill using Microsoft Edge TTS engine with real-time streaming playback support. ## Features 功能特点 - **Edge TTS Engine** - High quality text-to-speech using Microsoft Edge - **Streaming Playback** - Real-time audio streaming (边生成边播放) - **Multiple Voices** - Support for Chinese, English, Japanese, Korean voices - **Customizable** - Adjust rate, volume, and pitch - **Secure Implementation** - No command injection vulnerabilities ## Installation 安装 ### 1. Install Python dependencies ```bash pip install edge-tts ``` ### 2. Install ffmpeg (required for streaming) **Windows:** Download from: https://github.com/GyanD/codexffmpeg/releases Extract and add `bin` folder to PATH **macOS:** ```bash brew install ffmpeg ``` **Linux:** ```bash sudo apt install ffmpeg ``` ## Usage 使用 ### Streaming Playback (Recommended) 流式播放（推荐） Real-time audio generation and playback: ```javascript // Basic usage await skill.execute({ action: 'stream', text: '你好，我是小九' }); // With custom voice await skill.execute({ action: 'stream', text: 'Hello, how are you?', options: { voice: 'en-US-Standard-A', rate: '+10%', volume: '+0%', pitch: '+0Hz' } }); ``` ### Text-to-Speech with File 生成语音文件 ```javascript await skill.execute({ action: 'tts', text: 'Hello, how are you today?', options: { voice: 'zh-CN-XiaoxiaoNeural' } }); // Returns: { success: true, media: 'MEDIA: /path/to/file.mp3' } ``` ### Direct Speak 直接播放 ```javascript await skill.execute({ action: 'speak', text: 'Hello!' }); ``` ### List Available Voices 查看可用语音 ```javascript await skill.execute({ action: 'voices' }); ``` ## Available Voices 可用语音 | Language | Voice ID | |----------|----------| | Chinese (Female) | zh-CN-XiaoxiaoNeural | | Chinese (Male) | zh-CN-YunxiNeural | | Chinese (Male) | zh-CN-YunyangNeural | | English (US Female) | en-US-Standard-A | | English (US Male) | en-US-Standard-D | | English (UK) | en-GB-Standard-A | | Japanese | ja-JP-NanamiNeural | | Korean | ko-KR-SunHiNeural | ## Options 参数 | Option | Default | Description | |--------|---------|-------------| | voice | zh-CN-XiaoxiaoNeural | Voice ID | | rate | +0% | Speech rate (-50% to +100%) | | volume | +0% | Volume adjustment (-50% to +50%) | | pitch | +0Hz | Pitch adjustment | ## Security 安全 This skill implements **enterprise-grade security** best practices: ### 🛡️ Security Features | Feature | Implementation | |---------|----------------| | **Input Validation** | Voice parameter whitelist validation - only allowed voices can be used | | **No Shell Execution** | Uses `spawn()` with array arguments instead of shell command concatenation | | **Command Injection Prevention** | All user inputs are properly validated and escaped | | **Path Safety** | Fixed script path prevents path traversal | ### Security Details ```javascript // ❌ UNSAFE - Don't use exec with string concatenation exec(`py script.py "${userText}" --voice ${userVoice}`); // ✅ SAFE - Use spawn with array arguments spawn('py', [scriptPath, text, '--voice', voice], { shell: false }); ``` ### Voice Whitelist Only these voices are allowed: ```javascript const allowedVoices = [ 'zh-CN-XiaoxiaoNeural', 'zh-CN-YunxiNeural', 'zh-CN-YunyangNeural', 'zh-CN-YunyouNeural', 'zh-CN-XiaomoNeural', 'en-US-Standard-C', 'en-US-Standard-D', 'en-US-Wavenet-F', 'en-GB-Standard-A', 'en-GB-Wavenet-A', 'ja-JP-NanamiNeural', 'ko-KR-SunHiNeural' ]; ``` Any invalid voice parameter will be rejected and replaced with the default voice. ## Changelog 更新日志 ### v1.10 (2026-02-24) - **Enterprise-grade security** - Full command injection protection - Voice whitelist validation - Replaced exec with spawn for secure process execution - Input sanitization for all parameters ### v1.1.0 - Add streaming playback support (边生成边播放) - Add ffmpeg dependency - Fix command injection vulnerability - Add voice whitelist validation ### v1.0.0 - Initial release with basic TTS support

path: CHANGELOG.md
content: # Changelog

## v1.10 (2026-02-24)

### Security Updates (安全更新)
- **Enterprise-grade security** - Full command injection protection
- Voice whitelist validation - only pre-approved voices can be used
- Replaced `exec()` with `spawn()` with array arguments
- Input sanitization for all parameters
- Shell execution disabled (`shell: false`)

### Features
- Streaming playback support (real-time audio while generating)
- Multiple voice support (Chinese, English, Japanese, Korean)
- Customizable rate, volume, and pitch

## v1.0.0 (2026-02-23)

### Added
- Initial release
- Basic TTS using edge-tts
- Multiple voice support
- Rate/volume/pitch adjustment


path: example.js
content: // Example usage of the Voice skill

async function example() {
  // Import the Voice skill
  const VoiceSkill = require('./index.js');
  const skill = new VoiceSkill();

  try {
    // Basic text-to-speech
    console.log('Creating basic speech...');
    let result = await skill.execute({
      action: 'tts',
      text: 'Hello, this is a demonstration of the voice skill.'
    });
    console.log(result.message);
    console.log('Media link:', result.media);

    // Advanced text-to-speech with options
    console.log('\nCreating speech with custom options...');
    result = await skill.execute({
      action: 'tts',
      text: 'This speech has custom speed and volume settings.',
      options: {
        voice: 'en-US-Wavenet-F',
        rate: '+20%',
        volume: '+10%'
      }
    });
    console.log(result.message);
    console.log('Media link:', result.media);

    // Clean up temporary files
    console.log('\nCleaning up temporary files...');
    result = await skill.execute({
      action: 'cleanup',
      options: {
        hoursOld: 1  // Only clean files older than 1 hour
      }
    });
    console.log(result.message);

  } catch (error) {
    console.error('Error during execution:', error.message);
  }
}

// Uncomment the next line to run the example
// example();

module.exports = VoiceSkill;

path: package.json
content: {
  "name": "openclaw-voice-skill",
  "version": "1.1.0",
  "description": "Enhanced voice skill for OpenClaw providing improved text-to-speech functionality with direct playback",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [
    "openclaw",
    "skill",
    "voice",
    "tts",
    "text-to-speech",
    "audio",
    "playback"
  ],
  "author": "zhaov1976",
  "license": "MIT",
  "dependencies": {
    "edge-tts": "^1.0.0"
  }
}

path: README.md
content: # Voice (Edge TTS)

Text-to-speech skill using Microsoft Edge TTS with real-time streaming playback.

## Quick Start

```bash
# Install dependencies
pip install edge-tts

# Install ffmpeg (for streaming)
# Windows: https://github.com/GyanD/codexffmpeg/releases
# macOS: brew install ffmpeg
# Linux: sudo apt install ffmpeg
```

## Usage

```javascript
// Streaming playback (recommended)
await skill.execute({
  action: 'stream',
  text: '你好，我是小九'
});
```

See SKILL.md for full documentation.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)