Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Feishu Voice Message

v1.0.0

Generate Feishu voice messages (with waveform) from text. Auto-converts to OPUS format for in-chat playback on both mobile and desktop. 从文本生成飞书语音消息(带波形图)。自动转...

0· 102·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for systiger/feishu-voice-message.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Feishu Voice Message" (systiger/feishu-voice-message) from ClawHub.
Skill page: https://clawhub.ai/systiger/feishu-voice-message
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install feishu-voice-message

ClawHub CLI

Package manager switcher

npx clawhub@latest install feishu-voice-message
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description claim generation of Feishu voice messages and show examples of sending to Feishu, but the provided Python script only generates MP3 and converts to OPUS and stops — it does not call Feishu APIs or upload files. That is an overclaim or missing functionality. Also the script invokes a node script at ~/.openclaw/workspace/skills/edge-tts/scripts/tts-converter.js, which is an undeclared, hard-coded dependency not described in SKILL.md or manifest.
!
Instruction Scope
SKILL.md instructs installing edge-tts and ffmpeg and shows Feishu API examples and 'agent: generates and sends .opus file', but the runtime Python instructions only create files locally. The agent-facing phrasing may lead users to expect automatic uploading; the actual code does not. The script also executes an external node script by path, which grants that external file the ability to run arbitrary code when this skill is used.
Install Mechanism
There is no install spec (instruction-only), which minimizes installation footprint. However SKILL.md requires npm edge-tts and system ffmpeg. The Python script does not call npm directly but calls node on a specific path under ~/.openclaw — a hidden reliance on another skill or local file that may not exist or that could be tampered with.
Credentials
The skill requests no credentials or secrets and only uses the TEMP environment variable to choose a temp path. No disproportionate access to unrelated credentials or config paths is requested.
Persistence & Privilege
always is false and the skill does not request persistent or privileged system presence. It does not modify other skills or system settings.
What to consider before installing
This skill is useful as a local generator (text → MP3 → OPUS) but it has two important issues you should consider before installing or running it: 1) Functional mismatch: The published description and SKILL.md imply that the skill will upload/send voice messages to Feishu, but the included Python script only generates & converts audio files and prints their paths — it does not call Feishu APIs or perform any upload. If you expect automatic sending to Feishu, that functionality is missing and would require additional code and Feishu credentials. 2) Hidden/external dependency: The script calls node on a hard-coded path (~/.openclaw/workspace/skills/edge-tts/scripts/tts-converter.js). That file is not included in this package and is not a standard location for the edge-tts npm package. Before running, verify that the referenced node script exists and review its contents — it will execute with your user privileges and could run arbitrary code. If it does not exist, the script will fail. Other considerations: - The skill requires installing edge-tts (npm) and ffmpeg; install packages only from sources you trust. - The Python script passes the TTS text as CLI arguments to node (subprocess list used, not a shell string), which reduces but does not eliminate risk from untrusted inputs. - Files are written to a temp path (TEMP or /tmp/openclaw), so check filesystem permissions and cleanup needs. Recommendations before use: inspect the node tts-converter.js that this script calls (or change the script to call a known installation of edge-tts), confirm whether you need Feishu upload code (and if so add proper credential handling), and only run after verifying the external node script and npm package sources. If you want a safe, local-only usage, treat this as an audio generator/converter and do not expect automatic Feishu delivery.

Like a lobster shell, security has layers — review code before you run it.

latestvk97abd0c8dbkh3kjg35cyb76cn83tf6q
102downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

Feishu Voice Message / 飞书语音消息

Generate Feishu voice messages that play directly in chat (with waveform display) on both mobile and desktop.

生成飞书语音消息,手机和电脑端都能在聊天中直接播放(带波形图显示)。

Key Discovery / 核心发现

Feishu voice messages require OPUS format, not MP3!

飞书语音消息需要 OPUS 格式,不是 MP3!

Format 格式Display 显示Desktop 电脑端
.opusVoice message (waveform) 语音消息(波形图)✅ Click to play 点击播放
.mp3Regular file 普通文件Need download 需下载播放

Voice Presets / 音色预设

Adult Voices / 成人音色

Preset 预设Voice 音色Pitch 音调Rate 语速Use Case 适用场景
manboXiaoyiNeural+50HzdefaultLively, energetic 活泼有活力
xiaoyiXiaoyiNeuraldefault+30%Fast-paced, news 快节奏
xiaoxiaoXiaoxiaoNeuraldefaultdefaultNatural, general 自然通用
yunyangYunyangNeuraldefault+10%Narration, documentary 旁白纪录片

Kids Voices / 儿童音色

Preset 预设Voice 音色Pitch 音调Rate 语速Use Case 适用场景
xiaotangdouXiaoyiNeural+15%-5%Lively, animation, stories 活泼童趣
mianhuatangXiaoxiaoNeural+5%-10%Gentle, bedtime stories 温柔故事
xiaomengmengXiaoxiaoNeural+10%-5%Friendly, educational 亲切教育

Usage / 使用方法

Command Line / 命令行

# Basic usage / 基本用法
python scripts/feishu_voice.py "Your text here" --preset manbo

# Kids voice / 儿童音色
python scripts/feishu_voice.py "儿童故事内容" --preset xiaotangdou

Via Agent / 通过代理

# Just ask the agent to generate voice message
# 直接让代理生成语音消息

User: 帮我生成一个语音消息:"你好,欢迎使用飞书!" 用小糖豆音色
Agent: [Generates and sends .opus file]

Requirements / 系统要求

  1. Edge TTS - Node.js package for text-to-speech

    npm install edge-tts
    
  2. FFmpeg - For MP3 to OPUS conversion

    # Windows: Download from https://ffmpeg.org
    # Mac: brew install ffmpeg
    # Linux: sudo apt install ffmpeg
    

Technical Details / 技术细节

Workflow / 工作流程

  1. TTS Generation → Generate MP3 using Edge TTS
  2. Format Conversion → Convert MP3 to OPUS using FFmpeg
  3. Send to Feishu → Upload as voice message
Text → Edge TTS → MP3 → FFmpeg → OPUS → Feishu Voice Message

FFmpeg Conversion Command / 转换命令

ffmpeg -i input.mp3 -c:a libopus -b:a 64k output.opus

MIME Types / MIME 类型

When sending to Feishu, use correct MIME type:

// Voice message (clickable on desktop)
message({ action: "send", path: "audio.opus", mimeType: "audio/opus" })

// Regular file (download required on desktop)
message({ action: "send", path: "audio.mp3", mimeType: "audio/mpeg" })

Limitations / 限制

  • Maximum file size: 30MB / 最大文件大小:30MB
  • OPUS is the only format for voice messages / OPUS 是语音消息的唯一格式
  • Requires FFmpeg for conversion / 需要安装 FFmpeg 进行转换

References / 参考资料


Created by / 创建者: systiger
Version / 版本: 1.0.0
ClawHub: https://clawhub.ai/systiger/feishu-voice-message

Comments

Loading comments...