Back to skill
Skillv1.0.0
ClawScan security
Chinese TTS · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 6, 2026, 3:20 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's purpose (Chinese TTS → Feishu voice) matches the included script and instructions, but there are mismatches and hard-coded assumptions (undeclared required binaries, absolute paths) that make the package brittle and potentially risky if deployed without review.
- Guidance
- This skill appears to do what it says (generate Chinese TTS and prepare an opus file for Feishu), but review before installing: 1) Confirm you trust the edge-tts binary at /home/clawpi/.local/bin/edge-tts (it may contact Microsoft servers to synthesize speech). 2) Ensure ffmpeg is available and that the workspace path (/home/node/.openclaw/workspace or equivalent) exists and is writable by the agent — the script assumes hard-coded absolute paths that may not match your environment. 3) The package metadata does not declare required binaries; treat this as a configuration/packaging bug and either update the skill metadata or adapt paths. 4) Verify your Feishu integration and mediaLocalRoots policy — the SKILL.md relies on the platform to upload the generated .opus file. 5) If you need stronger assurance, run the script in an isolated environment, or replace hard-coded paths with configurable ones and audit the edge-tts binary/source before use.
Review Dimensions
- Purpose & Capability
- concernThe skill claims no required binaries or env vars, but both SKILL.md and scripts call /home/clawpi/.local/bin/edge-tts and ffmpeg and reference a workspace path (/home/node/.openclaw/workspace). Requiring edge-tts and ffmpeg is appropriate for a TTS-to-Feishu skill, but the skill metadata should declare those binaries and not rely on hard-coded user-specific absolute paths.
- Instruction Scope
- noteInstructions and script are narrowly focused on generating MP3 via edge-tts, converting to opus with ffmpeg, and sending via Feishu. They do not attempt to read unrelated system secrets. However examples and the script use /tmp and hard-coded workspaces and show a pseudo call message(...); the actual Feishu send relies on platform integration being present and correctly configured.
- Install Mechanism
- noteNo install spec (instruction-only) — low installation risk. But the skill assumes presence of external binaries (edge-tts, ffmpeg) which are not declared. The edge-tts binary path is non-standard and user-specific, which is an operational concern (could run an unexpected binary if path differs).
- Credentials
- okThe skill requests no credentials and the script only exports UTF-8 locale env vars. No secrets are requested. Be aware that edge-tts is a Microsoft client and may send text to remote services (expected for that tool).
- Persistence & Privilege
- okalways is false and the skill does not request or change persistent agent/system configuration. It does not ask to modify other skills or system-wide settings.