aliyun-qwen-tts

The code is primarily a legitimate text-to-speech wrapper and contains no clear malware, persistence, destructive behavior, or explicit data theft. However, it has meaningful security weaknesses: an untrusted request can redirect API-key-bearing requests through base_url, and an unvalidated API-provided audio URL can trigger arbitrary outbound requests and downloads. Restrict the API endpoint to an allowlist, validate audio URLs to HTTPS and expected hosts, avoid loading .env files from untrusted repositories, and constrain output paths.