A multi-functional audio generation tool for SFX generation, video-to-audio and text-to-audio. 多功能音频生成工具，集成可控视频生成音频、文本生成音频等功能.
Security Analysis
high confidenceThe skill's code and instructions match its stated audio-generation purpose; it uploads provided media to a remote ControlFoley service and returns generated audio — no unexplained credentials or hidden persistence were found.
The skill's name/description (audio SFX, V2A, T2A) align with the included script and API references. Minor inconsistency: the registry metadata lists no required binaries, but SKILL.md and scripts rely on python3 and call curl (subprocess). SKILL.md also mentions ffmpeg as optional. These binaries are reasonable for the stated purpose but should be declared in metadata.
SKILL.md and scripts limit actions to submitting tasks to the specified API, polling for status, downloading results, and writing outputs to the chosen output directory. The code checks input file existence and does not read unrelated system files or environment variables. The main runtime behavior is uploading user-provided media/text to the remote API and saving returned files.
There is no install spec; this is an instruction-only skill with a bundled Python script. No installers, third-party packages, or arbitrary downloads are performed by the skill itself.
The skill declares no environment variables or credentials and the code does not attempt to access secrets. All network communication goes to controlfoley.ai.xiaomi.com (and documented fallback endpoints). No unrelated service credentials are requested.
The skill is not always-enabled and does not modify other skills or system-wide configuration. It runs on invocation and does not request special persistent privileges.
Guidance
This skill uploads any video, audio, or prompt you provide to a remote service (https://controlfoley.ai.xiaomi.com) and saves returned audio locally. Before installing or using it: (1) confirm you trust the remote endpoint and avoid uploading sensitive or private media, (2) note that the script invokes the local curl binary (and requires python3); SKILL.md also mentions ffmpeg for optional conversions — ensure those tools are installed if needed, (3) review the referenced upstream GitHub/project pages yourself to verify provenance and privacy policy, and (4) if you need an offline or self-hosted workflow, this skill is not suitable because it relies on the remote API.
Latest Release
v1.0.8
- Updated privacy and security section to add clear guidelines on data handling, processing, and user recommendations. - Removed duplicated and verbose API usage examples to streamline documentation. - Kept the API and CLI usage, parameters, and error handling instructions unchanged. - No functional or interface changes; documentation improvements only.
Popular Skills
Published by @yjx-research on ClawHub
