feishu-asr

使用本地Whisper模型识别飞书语音消息。离线免费，不需要注册，不需要联网。

Security Scan

The skill claims to run fully offline, but the code forces a third‑party HF mirror and will download Whisper models at runtime; the README also asks for cloud credentials that the code does not use — these inconsistencies warrant caution.

Purpose & Capability

The name/description promise '本地...离线免费，不需要联网', but the code uses transformers.from_pretrained which downloads models and explicitly sets HF_ENDPOINT to https://hf-mirror.com. The README asks for FEISHU_APP_ID/SECRET and cloud ASR keys (Aliyun/Tencent) even though the provided script does not use those credentials. Requiring or suggesting remote model downloads (and unrelated cloud credentials) is inconsistent with the 'offline' claim.

Instruction Scope

SKILL.md and scripts instruct the agent to download models via Hugging Face (with HF_ENDPOINT set to a specific mirror). The SKILL.md mentions fetching file_key from Feishu and downloading audio, but the shipped script is a standalone CLI that takes a local file path and does not implement Feishu API calls or consume FEISHU_* env vars. The script also unconditionally overwrites HF_ENDPOINT in os.environ, forcing use of a particular external mirror — an unexpected outbound network action compared to the 'offline' description.

Install Mechanism

There is no explicit install spec (instruction-only + one script). That minimizes installer risk, but the runtime will trigger large model downloads via transformers.from_pretrained. The mirror URL is not a well-known official release host; model artifacts will be fetched at runtime. Also, the script imports resampy conditionally but pip install instructions in SKILL.md do not list resampy.

Credentials

Declared requirements are none, but README suggests FEISHU_APP_ID/FEISHU_APP_SECRET and cloud ASR keys. The code does not use those env vars; instead it hardcodes HF_ENDPOINT to a third‑party mirror. Asking users to configure unrelated credentials (Feishu or Aliyun) in documentation while the code ignores them is disproportionate and confusing — could lead users to supply sensitive credentials unnecessarily.

Persistence & Privilege

The skill is not always-enabled and does not request persistent privileges or modify other skills or system-wide configs. It only writes a transient temp WAV file and deletes it. Autonomous invocation is allowed (platform default) but not combined here with other high-risk features.

What to consider before installing

This skill's description says 'offline', but the code will download Whisper models at first run and forces HF_ENDPOINT to https://hf-mirror.com — so network access and a third‑party mirror are involved. The README also asks you to set Feishu and cloud ASR credentials even though the included script never uses them. Before installing or running: (1) do not provide platform/cloud credentials (FEISHU_*, ALIYUN_*, etc.) unless you confirm the skill actually needs them; (2) treat the mirror (https://hf-mirror.com) as an external endpoint — ask the author for provenance or replace it with an official source you trust; (3) run initial tests in an isolated environment with network monitoring to see what is downloaded; (4) note that resampy is used but not listed in pip instructions — add missing dependency if you run it locally; (5) ask the maintainer to clarify the offline claim or to provide an explicitly bundled, offline model if truly intended. If you cannot verify the mirror’s trustworthiness or the author’s intent, avoid supplying any sensitive credentials.

飞书语音识别 ASR

触发条件

• 用户发送飞书语音消息
• 用户要求将语音转为文字
• 用户提到"语音识别"、"转文字"

工作流程

1. 获取语音文件

从飞书消息中获取语音文件的file_key，下载为.ogg或.m4a格式。

2. 音频格式转换

使用Python soundfile将音频转换为16kHz采样的WAV格式：

import soundfile as sf
audio, sr = sf.read(voice_file)
# 如果是立体声，转为单声道
if len(audio.shape) > 1:
    audio = audio.mean(axis=1)
sf.write('output.wav', audio, 16000)

3. 使用Whisper识别

import os
os.environ['HF_ENDPOINT'] = 'https://hf-mirror.com'  # 国内镜像

from transformers import WhisperForConditionalGeneration, WhisperProcessor, WhisperFeatureExtractor
import soundfile as sf

# 读取音频
audio, sr = sf.read('output.wav')
if len(audio.shape) > 1:
    audio = audio.mean(axis=1)

# 加载模型
processor = WhisperProcessor.from_pretrained('openai/whisper-tiny')
model = WhisperForConditionalGeneration.from_pretrained('openai/whisper-tiny')
feature_extractor = WhisperFeatureExtractor.from_pretrained('openai/whisper-tiny')

# 识别
input_features = feature_extractor(audio, sampling_rate=16000, return_tensors='pt').input_features
with torch.no_grad():
    predicted_ids = model.generate(input_features)

result = processor.batch_decode(predicted_ids, skip_special_tokens=True)[0]

依赖安装

pip install torch transformers soundfile

模型选择

• whisper-tiny: 75MB，适合CPU，最快
• whisper-base: 142MB，精度更好
• whisper-small: 466MB，精度高

注意事项

• 首次运行需要下载模型（约75MB-3GB）
• 建议使用国内镜像：HF_ENDPOINT=https://hf-mirror.com
• 模型会自动检测语言