Feishu Voice Skill
v1.2.0让 AI 助手能够给飞书用户发送真正的语音条（点击即播，不是文件附件）。支持 NoizAI TTS 生成语音，自动转换为 OPUS 格式，通过飞书 API 发送语音消息。
⭐ 0· 403·4 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (Feishu voice messages using NoizAI TTS) align with the code and scripts, which call NoizAI, run ffmpeg, upload to Feishu, and send audio messages. However, registry metadata presented earlier incorrectly listed "Required env vars: none" while the script and clawhub.yaml clearly require FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_CHAT_ID and NOIZ_API_KEY — an inconsistency in packaging/manifest.
Instruction Scope
SKILL.md and scripts instruct only to generate TTS, convert to OPUS, upload to Feishu, and send. The runtime script reads only provided text/files, uses mktemp for temporary files, and calls known endpoints (api.noiz.ai and open.feishu.cn). It does not attempt to read unrelated system files or extra environment variables. Note: SKILL.md suggests the NoizAI key should be base64-encoded, but the script uses NOIZ_API_KEY directly (no decoding) — a mismatch that affects function but not a secret-exfiltration behavior.
Install Mechanism
No install spec is provided (instruction-only plus included scripts). That is low-risk; the skill will run local shell scripts and expects ffmpeg, python3, curl to be present. Nothing is downloaded from untrusted URLs at install time.
Credentials
The script legitimately requires Feishu credentials (app id/secret/chat id) and a NoizAI API key to perform its function. That level of credential access is proportional to sending messages and calling a TTS API. The manifest/registry metadata omission of these required env vars is misleading and should be corrected. Treat FEISHU_APP_SECRET and NOIZ_API_KEY as sensitive secrets.
Persistence & Privilege
The skill does not request permanent/always-on installation and does not modify other skills or system-wide agent settings. It runs only when invoked and cleans up temporary files.
Assessment
This skill appears to do what it says: generate TTS (NoizAI), convert to OPUS with ffmpeg, upload to Feishu, and send an audio message. Before installing or running it: 1) Verify and set the required environment variables (FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_CHAT_ID, NOIZ_API_KEY) — the registry metadata omitted these, so don't rely on that summary. 2) Test locally using --no-send to confirm audio generation and conversion without sending messages. 3) Note SKILL.md's suggestion to base64-encode NOIZ_API_KEY but the script does not decode it; provide the key in the format the NoizAI API expects. 4) Ensure the Feishu app has only the necessary permissions (im:message, im:message:send_as_bot, im:resource) and follow least-privilege practices. 5) Review the scripts yourself (they are plain Bash) and run in a controlled environment if the source is untrusted. If you need higher assurance, ask the author for a canonical repository URL and an updated manifest that correctly lists required env vars and any expected header formats.Like a lobster shell, security has layers — review code before you run it.
latestvk975yxn4gqwswm3xvjdhze3pbd82fr5f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.