Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Feishu Voice Message
v1.0.0Generate Feishu voice messages (with waveform) from text. Auto-converts to OPUS format for in-chat playback on both mobile and desktop. 从文本生成飞书语音消息(带波形图)。自动转...
⭐ 0· 49·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description claim generation of Feishu voice messages and show examples of sending to Feishu, but the provided Python script only generates MP3 and converts to OPUS and stops — it does not call Feishu APIs or upload files. That is an overclaim or missing functionality. Also the script invokes a node script at ~/.openclaw/workspace/skills/edge-tts/scripts/tts-converter.js, which is an undeclared, hard-coded dependency not described in SKILL.md or manifest.
Instruction Scope
SKILL.md instructs installing edge-tts and ffmpeg and shows Feishu API examples and 'agent: generates and sends .opus file', but the runtime Python instructions only create files locally. The agent-facing phrasing may lead users to expect automatic uploading; the actual code does not. The script also executes an external node script by path, which grants that external file the ability to run arbitrary code when this skill is used.
Install Mechanism
There is no install spec (instruction-only), which minimizes installation footprint. However SKILL.md requires npm edge-tts and system ffmpeg. The Python script does not call npm directly but calls node on a specific path under ~/.openclaw — a hidden reliance on another skill or local file that may not exist or that could be tampered with.
Credentials
The skill requests no credentials or secrets and only uses the TEMP environment variable to choose a temp path. No disproportionate access to unrelated credentials or config paths is requested.
Persistence & Privilege
always is false and the skill does not request persistent or privileged system presence. It does not modify other skills or system settings.
What to consider before installing
This skill is useful as a local generator (text → MP3 → OPUS) but it has two important issues you should consider before installing or running it:
1) Functional mismatch: The published description and SKILL.md imply that the skill will upload/send voice messages to Feishu, but the included Python script only generates & converts audio files and prints their paths — it does not call Feishu APIs or perform any upload. If you expect automatic sending to Feishu, that functionality is missing and would require additional code and Feishu credentials.
2) Hidden/external dependency: The script calls node on a hard-coded path (~/.openclaw/workspace/skills/edge-tts/scripts/tts-converter.js). That file is not included in this package and is not a standard location for the edge-tts npm package. Before running, verify that the referenced node script exists and review its contents — it will execute with your user privileges and could run arbitrary code. If it does not exist, the script will fail.
Other considerations:
- The skill requires installing edge-tts (npm) and ffmpeg; install packages only from sources you trust.
- The Python script passes the TTS text as CLI arguments to node (subprocess list used, not a shell string), which reduces but does not eliminate risk from untrusted inputs.
- Files are written to a temp path (TEMP or /tmp/openclaw), so check filesystem permissions and cleanup needs.
Recommendations before use: inspect the node tts-converter.js that this script calls (or change the script to call a known installation of edge-tts), confirm whether you need Feishu upload code (and if so add proper credential handling), and only run after verifying the external node script and npm package sources. If you want a safe, local-only usage, treat this as an audio generator/converter and do not expect automatic Feishu delivery.Like a lobster shell, security has layers — review code before you run it.
latestvk97abd0c8dbkh3kjg35cyb76cn83tf6q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
