🗣️ Text-to-speech using GLM-TTS for generating audio

Name/description (GLM-TTS via uvx) match the declared requirements: uvx binary and ZAI_AUDIO_USERID / ZAI_AUDIO_TOKEN environment variables are exactly what a CLI client to audio.z.ai would need.

SKILL.md only instructs running the uvx CLI with arguments and how to obtain credentials. It explicitly tells users to extract auth info from browser localStorage (JSON.parse(localStorage['auth-storage']).state.token), which is sensitive but directly related to authenticating to audio.z.ai; the instructions do not attempt to read other system files or unrelated credentials.

Install spec uses common package managers (brew or pip) for a package named 'uv' that provides uvx. Having both brew and pip installers is redundant but not inherently risky; no arbitrary download URLs or extracted archives are present.

Only two env vars (userId and token) are required, and the token is the primary credential — appropriate for a remote TTS service. However the recommended method to obtain them (copying a session token from localStorage) can encourage insecure handling of session tokens and may expose long-lived credentials if not managed carefully.

Skill does not request always:true, does not declare config paths, and does not modify other skills; autonomous invocation is default but not excessive for this type of integration.