Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Telegram Voice Group

向指定 Telegram 群组发送语音消息

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 2.7k · 6 current installs · 6 all-time installs
bysanwe@sanwecn
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The declared binaries (edge-tts and ffmpeg) and the included code align with sending TTS voice messages to Telegram groups. However the documentation recommends granting the bot broad admin permissions (Delete, Restrict, Ban, Add Admins) that are disproportionate to the stated function of sending voice messages. USE_CASES also describes web aggregation (Reddit/Twitter via web_fetch and bird CLI) which is not represented in required binaries or env vars — this is scope creep.
!
Instruction Scope
Runtime instructions and code are focused on generating TTS, converting to OGG/Opus, and sending via @openclaw/core message APIs. Problems: (1) index.js incorrectly extracts the group ID from a full session key (split index is wrong), which will break or misaddress messages; (2) the code uses child_process.exec with interpolated text (insufficient escaping), which can lead to shell injection if untrusted input is passed; (3) docs and USE_CASES suggest fetching and summarizing external web content (Reddit/Twitter) and running additional CLIs, though these tools are not declared as required — that capability could be used to aggregate and post external content to Telegram and represents scope expansion beyond the simple send-voice use case.
Install Mechanism
There is no install spec (instruction-only), which minimizes download risk. The package includes JS and a bash script but does not request external downloads. It does require the runtime availability of '@openclaw/core' (not listed in package.json deps) and the system binaries edge-tts and ffmpeg.
!
Credentials
The skill requests no environment credentials (which is appropriate), but the documentation instructs operators to give the OpenClaw bot elevated Telegram admin permissions (including banning and adding admins). Those elevated permissions are not necessary merely to send voice messages and enlarge the operational blast radius of the bot if misused. No other env vars or secrets are requested, which is reasonable.
Persistence & Privilege
The skill does not set always:true and does not modify other skills or system-wide settings. Autonomous model invocation is allowed by default (expected). The only persistent privilege recommendation is in the docs asking for broad Telegram admin rights for the bot — this is an external permission request rather than skill installation behavior, but it is noteworthy.
What to consider before installing
This skill appears to implement what it claims (generate TTS, convert with ffmpeg, and send to Telegram), but there are several concerns you should address before installing or enabling it: 1) Do not blindly grant the OpenClaw bot broad admin permissions (ban/add-admins/delete). For sending voice messages, send permissions/media are enough; avoid add-admins/ban/restrict unless you fully trust the bot. 2) The index.js has a bug extracting the group ID from a session key (it uses the wrong split index) — test that group/thread addressing works and correct the code (use the correct segment index). 3) The code invokes shell commands via child_process.exec with user-provided text; this can enable command injection. Prefer execFile/spawn with argument arrays or properly escape/sanitize input. 4) The docs suggest optional web aggregation (Reddit/Twitter) and extra CLIs — if you enable those flows, be aware the skill could collect external content and post it to your groups; only enable such integrations when you understand and trust them. 5) Verify that '@openclaw/core' messaging functions behave as expected in your environment and that temporary files are handled securely. If you are uncomfortable with these issues, test the skill in an isolated environment first, or request a corrected version that fixes the groupId parsing and avoids shell interpolation of unsanitized input.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.5
Download zip
latestvk97chnrrgfge1gn253t82pmakx80df6q

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🔊 Clawdis
OSLinux
Binsffmpeg, edge-tts

SKILL.md

Telegram 群组语音消息发送 (telegram-voice-group) 🔊

使用 Telegram 群组话题功能实现隔离上下文替代 Discord,并可以指定 Telegram 群组发送语音消息。

功能

  • 使用 Microsoft Edge-TTS 生成高质量中文语音
  • 转换为 Telegram 语音气泡兼容格式
  • 发送到指定的群组会话
  • 话题独立上下文:每个 Telegram 话题都有独立的会话上下文,格式为 agent:main:telegram:group:{groupId}:topic:{threadId}
  • 会话隔离:不同话题间的对话历史和上下文完全隔离,互不干扰,这使得 Telegram 群组话题功能可以有效替代 Discord 频道的组织功能
  • 支持向特定话题发送语音消息

依赖

  • edge-tts - 用于生成语音
  • ffmpeg - 用于格式转换

部署到 Telegram 群组完整教程

1. 创建 Telegram 群组

  • 打开 Telegram 应用
  • 点击右上角的 "+" 按钮
  • 选择 "新建群组" 或 "New Group"
  • 添加成员并设置群组名称和头像

2. 邀请 OpenClaw Bot 到群组

  • 在群组中点击群组名称进入群组信息页面
  • 点击 "添加成员" 或 "Add Member"
  • 搜索并选择你的 OpenClaw Bot(例如 @your_openclaw_bot)
  • 点击 "添加" 或 "Add"

3. 赋予 OpenClaw Bot 群组管理权限

  • 在群组信息页面,点击 OpenClaw Bot 的用户名
  • 选择 "提升为管理员" 或 "Promote to Admin"
  • 授予以下权限:
    • 删除消息 (Delete Messages)
    • 编辑群组信息 (Edit Group Info)
    • 发送消息 (Send Messages)
    • 发送媒体 (Send Media)
    • 限制成员 (Restrict Members)
    • 封禁成员 (Ban Members)
    • 添加管理员 (Add Admins) - 可选,根据需要

4. 获取群组的链接和 ID

  • 点击群组头像进入群组信息页面
  • 点击 "群组类型" 或 "Group Type" 下方的 "群组链接" 或 "Group Link"
  • 复制群组链接(例如 https://t.me/your_group_name)
  • 群组 ID 通常是链接后面的部分,或者在某些客户端可以直接看到数字 ID

5. 创建话题并获取话题序号

  • 在群组中,点击底部的 "+" 按钮
  • 选择 "新建话题" 或 "Create Topic"(如果群组启用了话题功能)
  • 设置话题名称
  • 点击话题头像进入话题详情
  • 查看邀请链接,链接末尾的数字即为话题序号(例如 https://t.me/your_group_name/123 中的 123)

6. 在 OpenClaw 中配置群组和话题

  • 将群组链接和 ID 发送给 OpenClaw Bot
  • 将话题序号发送给 OpenClaw Bot
  • 使用如下命令格式发送语音消息:
    向 agent:main:telegram:group:[GROUP_ID]:topic:[TOPIC_ID] 发送语音: 你的语音内容
    

使用方法

1. 直接在会话中使用此功能:

"向 {群组会话键} 发送语音: {语音内容}"

例如: "向 agent:main:telegram:group:[GROUP_ID]:topic:[TOPIC_ID] 发送语音: 大家好,我是[ASSISTANT_NAME],[NICKNAME]的AI助理。很高兴在[MOLTBOT_COMMUNITY]社区与大家见面,祝大家交流愉快!"

2. 通过 sessions_spawn 调用:

await sessions_spawn({
  task: "向 agent:main:telegram:group:[GROUP_ID]:topic:[TOPIC_ID] 发送语音: 这是一条测试消息",
  agentId: "telegram-voice-group"
})

3. 直接调用函数(在JS环境中):

const { sendVoiceToTelegramGroup } = require('./index.js');
await sendVoiceToTelegramGroup({
  text: "语音内容",
  groupId: "agent:main:telegram:group:[GROUP_ID]:topic:[TOPIC_ID]",
  voice: "zh-CN-XiaoxiaoNeural",
  rate: "+5%"
});

4. 向特定话题发送语音消息:

可通过 threadId 参数向特定话题发送语音消息:

const { message } = require('@openclaw/core');

await message({
  action: 'send',
  channel: 'telegram',
  to: '[GROUP_ID]',
  message: '语音消息内容',
  asVoice: true,
  media: '语音文件路径',
  threadId: [TOPIC_ID]  // 指定话题ID
});

5. 使用函数发送到指定话题:

const { sendVoiceToTelegramGroup } = require('./index.js');
await sendVoiceToTelegramGroup({
  text: "语音内容",
  groupId: "agent:main:telegram:group:[GROUP_ID]:topic:[TOPIC_ID]",
  voice: "zh-CN-XiaoxiaoNeural",
  rate: "+5%",
  threadId: [TOPIC_ID]  // 可选:指定话题ID
});

实现逻辑

当检测到用户请求向群组发送语音消息时,系统将自动执行以下步骤:

  1. 使用 edge-tts 生成语音文件

    edge-tts --voice zh-CN-XiaoxiaoNeural --rate=+5% --text "语音内容" --write-media /tmp/voice_msg.mp3
    
  2. 使用 ffmpeg 转换为 Telegram 兼容格式

    ffmpeg -y -i /tmp/voice_msg.mp3 -c:a libopus -b:a 48k -ac 1 -ar 48000 -application voip /tmp/voice_msg.ogg
    
  3. 使用 message 工具发送语音文件到指定群组

    message({action: 'send', channel: 'telegram', to: '[GROUP_ID]', message: '', asVoice: true, media: '/tmp/voice_msg.ogg', threadId: [TOPIC_ID]})
    

参数

  • 语音内容: 要转换为语音的文本
  • 群组会话键: 目标群组的完整会话键

技术规范

  • 生成 MP3 格式临时音频
  • 使用 FFmpeg 转换为 Telegram 兼容的 OGG Opus 格式
  • 音频参数:libopus编码,48k比特率,单声道,48kHz采样率,VOIP应用类型
  • 使用 asVoice: true 参数确保以语音气泡形式发送,而非文件
  • 自动清理临时文件
  • 文本格式清洗:自动移除 Markdown 标记、URL 链接和特殊符号,避免朗读出标记符号

文本格式清洗

为避免朗读出标记符号,技能会自动清洗文本内容:

需移除示例
Markdown 标记**加粗**`代码`# 标题
URL 链接https://example.com
特殊符号---***>>>

话题功能详解

完全替代 Discord 的能力

  • 话题独立上下文:每个 Telegram 话题都有独立的会话上下文,格式为 agent:main:telegram:group:{groupId}:topic:{threadId}
  • 会话隔离:不同话题间的对话历史和上下文完全隔离,互不干扰
  • 模型独立设置:可以在不同的话题中设置不同的 AI 模型
  • 上下文独立:每个话题维护自己的对话历史,就像 Discord 的不同频道一样

在不同话题中设置不同模型

  • 通过 OpenClaw 的会话管理功能,可以为每个话题(agent:main:telegram:group:{groupId}:topic:{threadId})单独配置 AI 模型
  • 每个话题的上下文完全独立,不会相互影响
  • 支持多话题并行运行,每个话题可以有不同的功能和配置

注意事项

  • 机器人必须已在目标群组中
  • 需要相应的消息发送权限
  • 语音内容应适合群组环境
  • 清洗后的文本将用于语音生成,确保朗读效果
  • 每个 Telegram 话题都有独立的会话上下文,格式为 agent:main:telegram:group:{groupId}:topic:{threadId}
  • 不同话题间的对话历史和上下文完全隔离,互不干扰,这使得 Telegram 群组话题功能可以有效替代 Discord 频道的组织功能

Files

9 total
Select a file
Select a file to preview.

Comments

Loading comments…