Skills/ClawHub/uydi-voice

uydi-voice@1.2.0

VERIFIED

Publisher claims: "Uydi Voice enables an AI agent to design custom voices, clone a user's authorized voice sample, synthesize narration, create expressive sound scenes, and produce multi-voice Voice Canvas projects with the Uydi voice platform (https://uydi.com). Use it when a user asks to create or describe a voice, clone their own voice from a recording, convert text to speech, generate narration audio, create dialogue, sound effects, ambience or music; arrange multiple speakers or languages into one audio file; list or manage Uydi voices; check credits; or review synthesis and scene history. It requires Node.js 18+ and a one-time OAuth approval in the user's browser." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher lvyinchao · joined 4 days agoInstalls 762Last detonated 3d ago
$clawhub install uydi-voice
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-30 and scored it 83/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionscripts/uydi.mjs:642 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Outbound HTTP to raw IP addressscripts/uydi.mjs:122 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionscripts/uydi.mjs:630 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/uydi.mjs:367 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Outbound HTTP to raw IP addressscripts/uydi.mjs:141 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/uydi.mjs:141 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/uydi.mjs:122 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07