飞书语音

This skill appears to do what it says (Feishu <-> ElevenLabs voice flows) but has some implementation and setup gaps you should address before installing or running it: - Feishu credentials: SKILL.md requires app_id/app_secret (used to obtain tenant_access_token) and the Node.js sample uses appId/appSecret, but the manifest does not declare or document these environment variables. Treat this as required credentials and only provide them after verifying who/what will store and use them. - ELEVENLABS key: The skill expects ELEVENLABS_API_KEY — keep it in a secure secret store, monitor usage and billing on ElevenLabs. - System install: The instructions call apt-get install -y ffmpeg. Running apt-get requires appropriate privileges and may not be appropriate on all hosts. If you cannot or do not want to install system packages, arrange an alternative (preinstalled ffmpeg, containerized execution, or use a hosted conversion service). - Workspace path and file handling: The doc references /root/.openclaw/workspace/ and temporary files. Confirm where temporary media will be stored and ensure least-privilege file paths (avoid using root-owned directories if not necessary). - Node runtime and dependencies: The Node.js example uses @larksuiteoapi/node-sdk but the manifest doesn't declare runtime requirements. If you plan to run the Node snippet, ensure Node and the SDK are installed securely and that dependency installation is reviewed. - Operational safety: Because the agent can run instructions, confirm whether the agent will execute commands autonomously. If you do not want autonomous installs or network calls, restrict invocation or require manual approval. What would increase confidence: a corrected manifest that declares required Feishu env vars (e.g., FEISHU_APP_ID, FEISHU_APP_SECRET or explicit guidance to use tenant_access_token), explicit runtime requirements (Node, ffmpeg), and clear secure-handling instructions for credentials and temporary files. If you cannot verify these, treat the skill with caution and avoid providing production credentials until you have validated the code in a controlled environment.