Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

飞书TTS Pro

v1.0.0

将文字转换为语音并以飞书语音气泡消息发送。使用 Edge-TTS(微软,免费,无限次)生成中文语音,FFmpeg 转码为 ogg/opus,上传到飞书作为 audio 类型消息。支持自定义音色、接收者和 Python 环境。当用户要求用语音回复、发语音消息、TTS 朗读内容时触发。

0· 24·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for minybear/feishu-tts-pro.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "飞书TTS Pro" (minybear/feishu-tts-pro) from ClawHub.
Skill page: https://clawhub.ai/minybear/feishu-tts-pro
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_DEFAULT_USER, EDGE_TTS_VOICE, PYTHON_BIN
Required binaries: ffmpeg
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install feishu-tts-pro

ClawHub CLI

Package manager switcher

npx clawhub@latest install feishu-tts-pro
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, SKILL.md, and the included bin/tts-send.js are consistent: they generate TTS via edge-tts, transcode with FFmpeg, and upload/send audio to Feishu. Requesting FEISHU_APP_ID and FEISHU_APP_SECRET is appropriate for Feishu integration.
Instruction Scope
Runtime instructions and the script stay within the stated scope: they spawn Python to run edge-tts, call ffmpeg/ffprobe for audio processing, write temporary files to the OS temp dir, and call only open.feishu.cn endpoints to upload and send messages. There are no unexpected external endpoints or broad file reads.
Install Mechanism
No install spec (instruction-only with a helper script). The SKILL.md documents installing edge-tts via pip; nothing is downloaded from arbitrary URLs. This is low install risk.
!
Credentials
Registry metadata lists FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_DEFAULT_USER, EDGE_TTS_VOICE, and PYTHON_BIN as required env vars, but SKILL.md and the script treat FEISHU_DEFAULT_USER, EDGE_TTS_VOICE, and PYTHON_BIN as optional (have defaults). The mismatch is confusing and could cause over-provisioning of secrets. The only truly necessary secrets for Feishu are the App ID/Secret.
Persistence & Privilege
always is false and the skill does not request system-wide configuration or permanently modify other skills. The skill uses temporary files and obtains transient tenant_access_token from Feishu — expected behavior for this function.
What to consider before installing
This skill's code appears to do what it claims, but there are small incoherences you should address before installing: 1) The registry marks EDGE_TTS_VOICE, PYTHON_BIN, and FEISHU_DEFAULT_USER as required env vars even though the README and script treat them as optional — don't provide more secrets than necessary; only FEISHU_APP_ID and FEISHU_APP_SECRET are essential. 2) The script calls ffprobe to measure duration but the metadata only requires ffmpeg; ensure ffprobe is available or add it to the requirements. 3) Review the FEISHU_APP_ID/FEISHU_APP_SECRET usage: installing this skill gives it the ability to obtain tenant tokens and send messages as the app — only grant an app with limited messaging scope and test in a controlled account. 4) Verify you have a safe Python environment with edge-tts installed (pip install edge-tts) and run the script in an isolated environment if you are uncertain. If you want higher assurance, ask the publisher for corrected metadata (declare ffprobe and mark optional env vars as optional) or request a signed / official source URL for the skill.
bin/tts-send.js:129
Shell command execution detected (child_process).
bin/tts-send.js:26
Environment variable access combined with network send.
!
bin/tts-send.js:90
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎤 Clawdis
Binsffmpeg
EnvFEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_DEFAULT_USER, EDGE_TTS_VOICE, PYTHON_BIN
latestvk97dhadgefzfvc09ht94540wfh85pxc1
24downloads
0stars
1versions
Updated 6h ago
v1.0.0
MIT-0

feishu-tts-pro

将中文文字转换为语音,直接发送为飞书语音气泡消息。

使用方法

# 发送语音消息(默认发送给 FEISHU_DEFAULT_USER)
tts-send "你好,这是番茄的语音回复"

# 发送给指定用户
tts-send "你好" ou_xxxxx

环境变量(必填)

变量说明
FEISHU_APP_ID飞书应用 App ID
FEISHU_APP_SECRET飞书应用 App Secret
FEISHU_DEFAULT_USER默认接收者的 open_id(可选,未提供时需要命令行参数)

环境变量(可选)

变量默认值说明
EDGE_TTS_VOICEzh-CN-YunxiNeuralEdge-TTS 音色
PYTHON_BIN系统 PythonPython 路径(用于 edge-tts)

可选音色

音色说明
zh-CN-YunxiNeural云希(男声,活泼阳光,默认)
zh-CN-XiaoxiaoNeural晓晓(女声,温和)
zh-CN-YunyangNeural云扬(男声,专业)
zh-CN-XiaoyiNeural晓逸(女声,甜美)
zh-CN-tianxiangNeural天祥(男声,大气)

技术流程

  1. Edge-TTS 生成 MP3(使用指定音色)
  2. FFmpeg 转码为 ogg/opus(16kHz, mono, 飞书兼容)
  3. 上传到飞书(file_type=opus,duration 嵌入)
  4. 发送 audio 消息气泡

依赖

  • Node.js 18+
  • Python 3.8+ + edge-tts(pip install edge-tts
  • FFmpeg(系统安装)

安装 edge-tts

pip install edge-tts

或使用 uv:

uv pip install edge-tts --python /path/to/your/python

配置示例

AGENTS.mdopenclaw.json 中配置:

{
  "skills": {
    "entries": {
      "feishu-tts-pro": {
        "env": {
          "FEISHU_APP_ID": "cli_xxxxxxxxxxxx",
          "FEISHU_APP_SECRET": "xxxxxxxxxxxxxxxx",
          "FEISHU_DEFAULT_USER": "ou_xxxxxxxxxxxx",
          "EDGE_TTS_VOICE": "zh-CN-YunxiNeural"
        }
      }
    }
  }
}

故障排除

TTS 生成失败

  • 确认 edge-tts 已安装:python -c "import edge_tts"
  • 确认 Python 路径正确

语音气泡无时长显示

  • 上传时需要传入 duration 参数(毫秒)
  • 脚本已自动处理

发送失败 (code=99991663)

  • 检查 App ID/Secret 是否正确
  • 确认飞书应用已开通「发消息」权限

Powered by 番茄 (OpenClaw Agent)

Comments

Loading comments...