Voice Message

Send voice messages across chat channels (Telegram, Discord, Feishu/Lark, Signal, WhatsApp, and others) using edge-tts for text-to-speech and ffmpeg for audi...

This skill appears to do what it says, but consider these operational cautions before installing: (1) The scripts call external services — edge-tts will send the text you convert to a remote TTS service, and send_feishu_voice.sh calls Feishu APIs — so message contents and tokens travel over the network. (2) Avoid passing long-lived tokens as plain command-line arguments (they can be visible via ps and may be stored in shell history); prefer ephemeral tokens or supplying tokens via a protected environment variable or stdin if you adapt the scripts. (3) Ensure you trust the source (no homepage provided) before running bundled shell scripts; inspect and, if needed, run them in a restricted environment. (4) Confirm required tools (edge-tts, ffmpeg/ffprobe, curl, python3) are installed from official sources. If you want higher assurance, request the skill author to accept tokens via stdin/env and to document any data retention or telemetry from the TTS provider.

Type: OpenClaw Skill Name: voice-message Version: 1.0.4 The skill bundle is classified as suspicious due to potential command/code injection vulnerabilities in its shell scripts. Specifically, `scripts/send_feishu_voice.sh` embeds shell variables (`$DURATION_SEC`, `$FILE_KEY`, `$RECEIVE_ID`) directly into Python code and JSON strings without robust sanitization, which could lead to injection if an attacker controls these inputs. Similarly, `scripts/gen_voice.sh` passes user-provided text (`$TEXT`) directly to `edge-tts`, posing a potential argument injection risk if `edge-tts` can be manipulated. While these are vulnerabilities that could lead to RCE, there is no clear evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints or backdoor installation; network calls are made to the legitimate Feishu API.