Feishu Voice Clone TTS Skill — 技能工具
v1.0.0Convert text to speech using Volcengine TTS with preset or cloned voices and send audio messages to Feishu chats or groups.
1· 322·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe code implements exactly what the skill claims (Volcengine TTS -> convert -> upload to Feishu), but metadata omissions and a couple undocumented local/config access points create small coherence concerns you should confirm before installing.
评估建议
This skill's code is coherent with its description, but the package/registry metadata omits required environment variables and binaries. Before installing: (1) Verify you trust the source — the author field/homepage are empty. (2) Provide dedicated Feishu and Volcengine credentials with minimal permissions (use a test app/service account), and do not reuse high-privilege secrets. (3) Ensure ffmpeg/ffprobe are installed in a controlled environment. (4) Be aware the script will read ~/.volcengine_...详细分析 ▾
ℹ 用途与能力
The script's behavior (call Volcengine TTS, convert with ffmpeg/ffprobe, upload to Feishu) matches the skill description. However the registry metadata lists no required environment variables or binaries while the SKILL.md and code do require FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_CHAT_ID, VOLC_API_KEY, VOLC_VOICE_TYPE and the ffmpeg/ffprobe binaries — this metadata omission is inconsistent and worth noting.
✓ 指令范围
Runtime instructions and code limit actions to: calling Volcengine TTS API, converting audio locally with ffmpeg/ffprobe, obtaining a Feishu tenant token, uploading the resulting audio file, and sending a message. The SKILL.md documents these steps. The code does optionally read a local config file (~/.volcengine_key) as an alternative API-key source — this is documented in README but is an extra local file access to be aware of.
✓ 安装机制
There is no install script or external download; the skill is delivered as source files. That reduces supply-chain risk. It does require system binaries (ffmpeg, ffprobe) and Python 'requests' at runtime; those prerequisites are mentioned in README but were not reflected in the registry's required-binaries field.
ℹ 凭证需求
The environment variables requested by the script (Feishu App ID/Secret, Feishu chat id, Volcengine API key and voice id) are appropriate and necessary for the described functionality. The script also supports reading ~/.volcengine_key for the Volcengine key — this config path was not declared in the registry metadata and gives the skill access to a home-directory file, which you should verify you want it to read.
✓ 持久化与权限
The skill is not force-enabled (always:false), does not persist or modify other skills or system-wide settings, and only runs on explicit invocation. It exchanges credentials with the Feishu/Volcengine APIs as expected and uses temporary files for audio data.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/6
Create
● 无害
安装命令 点击复制
官方npx clawhub@latest install feishu-voice-clone-tts
镜像加速npx clawhub@latest install feishu-voice-clone-tts --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制