openclaw-feishu-voice-free

OpenClaw 飞书语音聊天技能，基于本地 Qwen3-TTS 和 Whisper，实现离线多语言语音识别与合成，无需云端API。

Do not blindly copy or overwrite system OpenClaw config files or use the provided openclaw.json without review—it contains Feishu appId/appSecret values and a gateway token. Treat those as sensitive: remove or replace them with your own credentials. If you want strictly offline operation, avoid using the --remote option in scripts/tools/tts-base.py and ensure QWEN_TTS_REMOTE is unset. When starting the servers, prefer binding to localhost (127.0.0.1) rather than 0.0.0.0 to avoid exposing endpoints to the network, and run services under a non-root account. Review setup.sh and pip requirements before running (pip installs execute code). Only download models from official sources you trust, and verify any embedded credentials are not active. If you’re unsure, run the skill in an isolated VM or container first and audit network traffic to confirm no unexpected outbound connections.

Type: OpenClaw Skill Name: openclaw-feishu-voice-free Version: 1.0.0 The skill bundle provides legitimate offline voice-to-text and text-to-speech services using Whisper and Qwen3-TTS; however, it is classified as suspicious due to the inclusion of a highly sensitive configuration file (openclaw.json) containing plaintext Feishu appSecrets, appIds, and a gateway authentication token. Additionally, the tool integration relies on executing shell commands via 'bash -c' with curl, which presents a risk of command injection if input parameters like 'MediaPath' are not strictly sanitized by the host environment. The servers also bind to all network interfaces (0.0.0.0) by default in scripts like tts-base-server-openai.py and whisper-server.py, potentially exposing the local model services to the network without authentication.