Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

feishu-voice-sender - 飞书语音消息发送

v1.0.2

飞书语音消息发送器。基于 Edge TTS,一键将文字转为语音发送到飞书。 使用场景: - 发送语音通知/提醒到飞书 - 文字转语音自动播报 触发词:飞书语音、语音发送、tts、文字转语音

1· 432·3 current·3 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code and README align with the stated purpose: convert text to speech using edge-tts/ffmpeg and send the resulting OPUS to Feishu. Required packages (edge-tts, ffmpeg) are appropriate. Using the OpenClaw CLI to send messages is a plausible integration choice.
!
Instruction Scope
SKILL.md and README instruct installing edge-tts and ffmpeg and show how to run the script, but they do NOT mention that the script will call the local 'openclaw' CLI, write files under ~/.openclaw/media/outbound, or read FEISHU_CHAT_ID / OC_CHAT_ID from the environment. The script will run subprocesses and copy media into the agent's outbound media directory and then call 'openclaw message send' — these runtime actions are not documented in SKILL.md.
Install Mechanism
No install spec is present (instruction-only). The dependencies are typical (pip package and ffmpeg). No network downloads or archive extraction are performed by an install step in the skill bundle.
!
Credentials
Skill metadata declares no required env vars, but the code reads FEISHU_CHAT_ID and OC_CHAT_ID to determine the target chat when --target is not provided. The skill also relies on an existing 'openclaw' CLI (which presumably uses agent credentials) and writes media into ~/.openclaw/media/outbound. Accessing undeclared environment variables and leveraging the agent's send capability without documenting required credentials is a mismatch and raises privacy/permission concerns.
Persistence & Privilege
The skill is not always-enabled and does not request special platform privileges. However, when invoked it will create files under the user's ~/.openclaw directory and call the OpenClaw CLI to send messages — effectively using the agent's messaging capability. That means a successful run can post messages on the user's behalf using existing agent credentials; this is expected for a messaging integration but should be explicitly documented.
What to consider before installing
This skill appears to do what it claims (text->Edge TTS->OPUS->send to Feishu), but there are undocumented behaviors you should verify before installing: 1) The script reads FEISHU_CHAT_ID and OC_CHAT_ID from the environment when no --target is passed — those env vars are not declared in SKILL.md. If those variables are present they will be used as the destination. 2) The script invokes the local 'openclaw' CLI and copies files into ~/.openclaw/media/outbound; ensure you trust the openclaw tool and are comfortable with the skill posting messages using the agent's credentials. 3) SKILL.md/README don't document the openclaw dependency or the filesystem writes — ask the author to document required env vars and CLI dependencies, or inspect/modify the script to require explicit --target or confirmation before sending. If you proceed, consider testing in a controlled environment (no production chat IDs), review the code locally, and remove any FEISHU/OC chat env vars you don't want used automatically.

Like a lobster shell, security has layers — review code before you run it.

latestvk9726kmv59eedm517xmgtwp68182my2w
432downloads
1stars
3versions
Updated 41m ago
v1.0.2
MIT-0

Feishu Voice Sender - 飞书语音发送器

极简版 Edge TTS 语音发送工具,一键生成并发送到飞书。

特性

  • 🎙️ 单一供应商:Edge TTS(免费高质量)
  • 🎭 多语音选择:xiaoxiao、yunyang、yunxi 等
  • 🔄 自动格式转换:自动转为飞书 OPUS 格式
  • 📱 一键发送:生成后直接发送到飞书

安装依赖

pip install edge-tts
sudo apt-get install ffmpeg

快速开始

cd ~/.openclaw/skills/feishu-voice-sender/scripts

# 默认语音(xiaoxiao 温暖女声)
python3 voice_sender.py "你好老大,任务已完成"

# 指定语音
python3 voice_sender.py "系统告警" yunyang

语音列表

语音性别风格推荐场景
xiaoxiao温暖、专业⭐ 日常工作
yunyang专业、可靠正式通知
yunxi活泼、阳光轻松内容
xiaoyi活泼、卡通趣味内容
yunjian新闻播报紧急通知
xiaobei辽宁话幽默方言

使用示例

# 日常汇报
python3 voice_sender.py "老大,今日数据已更新"

# 紧急通知
python3 voice_sender.py "系统告警,服务器异常" yunjian

文件结构

feishu-voice-sender/
├── SKILL.md
└── scripts/
    └── voice_sender.py   # 极简版,单文件

极简 Edge TTS 飞书语音发送器

Comments

Loading comments...