Wecom Voice

Send native voice messages to WeCom using Windows TTS. Converts text to speech and sends as voice message (not audio file).

Security Scan

The skill's code generally matches its stated purpose (generate TTS, convert to AMR, send via OpenClaw), but there are mismatches and missing declarations (hardcoded ffmpeg path, undeclared CLI dependency) that make the package inconsistent and merit caution.

Purpose & Capability

The skill claims to convert text to AMR and send as a WeCom voice message — the script does exactly that. However the SKILL.md says "FFmpeg in PATH" while the script uses a hardcoded FFMPEG path under AppData/WinGet; SKILL.md does not list the openclaw CLI or PowerShell as required binaries even though the script calls both. These mismatches are disproportionate to the stated simple purpose and could cause unexpected behavior.

Instruction Scope

Instructions and script stay within the stated task: generate WAV via Windows System.Speech, convert with FFmpeg, and call 'openclaw message send' to deliver the AMR. The script writes a temporary PowerShell file into the media inbound directory and executes it, and it relies on the presence/configuration of the openclaw CLI (which will supply credentials implicitly). It does not read unrelated user files or transmit data to unknown endpoints.

Install Mechanism

No install spec (instruction-only plus one script) — lowest install risk. Nothing is being downloaded or extracted by the skill itself.

Credentials

The skill declares no required env vars, which is consistent with relying on local TTS and the user's existing OpenClaw CLI configuration. However the script implicitly depends on external binaries (PowerShell, FFmpeg, openclaw CLI) and uses a very specific hardcoded FFmpeg location instead of PATH; it will therefore rely on existing credentials/configuration held by the openclaw CLI without declaring them.

Persistence & Privilege

The skill is not marked always:true, does not request persistent system changes, and does not modify other skills or system-wide settings. It just writes temporary and output files into the user's ~/.openclaw/media/inbound directory.

What to consider before installing

This skill appears to do what it says (generate Windows TTS → convert → send via your OpenClaw CLI), but there are a few inconsistencies you should consider before installing or running it: - The script will execute a temporary PowerShell script (created under ~/.openclaw/media/inbound) and run ffmpeg and the openclaw CLI on your machine. Review the code and be comfortable with those actions. - The SKILL.md claims FFmpeg should be in PATH, but the code uses a hardcoded FFMPEG path under AppData/WinGet. If that path doesn't exist, the conversion will fail. Consider editing the script to use ffmpeg from PATH or make the ffmpeg path configurable. - The script calls 'openclaw message send' — it relies on your existing OpenClaw CLI configuration/credentials. Ensure you trust the CLI configuration and the target recipient before allowing the skill to run. If you want this skill but are cautious: manually inspect or run the script in a controlled environment (or modify it to use ffmpeg from PATH and to log less or prompt before sending). If the script started contacting unknown network endpoints, requested unrelated credentials, or attempted to read other user files, the assessment would be more severe.

WeCom Voice Message Sender

Send native voice messages to WeCom (企业微信) using Windows TTS.

Usage

# Basic
node scripts/send-voice.cjs "要说的内容"

# Specify target user
node scripts/send-voice.cjs "Hello" FanQi

How it works

1. TTS: Uses Windows System.Speech (Microsoft Huihui voice)
2. Convert: FFmpeg converts WAV to AMR (WeCom native voice format)
3. Send: OpenClaw CLI sends from media/inbound directory

Technical Details

• TTS Voice: Microsoft Huihui Desktop (中文)
• AMR Format: 8000Hz, mono, 12.2kbit/s
• Directory: Must send from ~/.openclaw/media/inbound

Files

• SKILL.md - This file
• scripts/send-voice.cjs - Main script