Openclaw Feishu Optimizer

提供语音识别、多语言支持及消息格式化，优化 OpenClaw 在飞书平台上的语音与文本消息处理和智能回复体验。

This skill appears to do what it says: convert audio to text and format replies. Before installing: (1) be aware audio is sent to Google's speech recognition service (network transmission of content — avoid sending sensitive audio), (2) install the Python packages in an isolated virtualenv rather than system-wide, (3) review the two Python files (they are short and readable) and avoid running the scripts on untrusted audio paths, (4) if you need an offline-only option for privacy, consider replacing the recognizer with an offline engine (e.g., VOSK) or request a version that supports local models, and (5) pin package versions and run in a sandboxed environment if you have elevated security concerns.

Type: OpenClaw Skill Name: openclaw-feishu-optimizer Version: 1.0.0 The skill is classified as suspicious due to the broad `Bash` execution permissions granted in `SKILL.md` (`allowed-tools: Bash(openclaw-feishu-optimizer:*)`). While the Python scripts (`process-message.py`, `voice-recognize.py`) do not directly construct malicious shell commands from user input, the `voice-recognize.py` script uses the `pydub` library for audio conversion. `pydub` often relies on external tools like `ffmpeg` which are executed via shell commands internally. A potential vulnerability in `pydub`'s handling of file paths or metadata when constructing these commands, combined with the skill's broad `Bash` permission, could create a shell injection risk. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints or persistence mechanisms.