Feishu Voice Bubble
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it claims—generate Feishu/Lark voice-bubble audio—but users should notice the npm dependency and that text is sent to Microsoft Edge TTS.
Before installing, be comfortable installing the node-edge-tts npm dependency, sending TTS text to Microsoft’s hosted service, and posting the resulting audio to the intended Feishu/Lark chat. Use non-sensitive text unless external processing is allowed, and verify the recipient before sending.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Generated audio may be posted into a Feishu/Lark chat if the agent follows the send workflow.
The skill documents using a Feishu send action to upload and send the generated .opus audio. This is the advertised purpose, but it is still an external chat-posting action.
{ "action": "send", "filePath": "output.opus" }Confirm the recipient, message text, and generated audio before sending, especially in workspaces or group chats.
The skill will depend on code from the npm ecosystem to generate audio.
The skill relies on a manually installed, unpinned npm dependency that is not represented by an install spec or lockfile. This is expected for the TTS helper but introduces dependency provenance risk.
npm install node-edge-tts
Install the expected package from a trusted source, consider pinning a known version, and review dependency provenance for sensitive environments.
Text converted to speech may be processed outside the local machine.
The documentation discloses that Edge TTS uses a Microsoft-hosted service, so text provided for speech generation may be sent to that external provider.
- Requires internet (Microsoft hosted service)
Avoid using confidential or regulated text unless sending it to Microsoft Edge TTS is acceptable under your privacy and workplace policies.