EnglishTutor

英语口语陪练助手。触发词：「练习英语」「我要说英语」「英语陪练」。功能：上传生词表 → 每日定时情景对话 → 语音输入即时纠错 → 飞书语音推送 → 自动艾宾浩斯复习。

Before installing or running this skill: - Expect to provide Feishu credentials (FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_USER_OPEN_ID), a MiniMax TTS key (or other TTS provider keys), and optional ASR/cloud keys — only supply credentials you trust and limit their scope where possible. - The skill will create/modify ~/.openclaw/english-tutor/config.json and may write a .env next to an existing Node.js feishu-voice.js (it looks for agents/english-tutor paths). Review the target feishu-voice.js file and be cautious about allowing writes to shared agents directories. - The scripts download large model files (hundreds of MB) from external hosts (GitHub, hf-mirror.com, modelscope.cn). Verify download URLs and, if possible, checksums before running in production. Run downloads in a sandbox or isolated environment first. - The SKILL.md and code reference many env vars that the registry metadata did not declare; confirm required variables and avoid providing unrelated secrets. - If you only want cloud TTS/ASR, avoid enabling local model downloads; conversely, if you enable local models, ensure sufficient disk space and verify sources. - Run scripts like scripts/check_env.py and inspect feishu-voice.js (the Node implementation the Python wrapper calls) before invoking; do not run as root and consider running in a disposable container or VM. If you want, I can list the exact env vars the code reads and the file paths the skill will write to, or help draft a minimal test plan to validate behavior in a sandbox.

Type: OpenClaw Skill Name: the-english-tutor Version: 2.0.0 The skill bundle implements a legitimate English tutoring service but employs high-risk credential handling and execution patterns. Specifically, `scripts/feishu_voice.py` writes sensitive API keys (Feishu, MiniMax) to a temporary `.env` file on the filesystem to pass them to a Node.js subprocess, which could lead to secret exposure if the script crashes or is interrupted. Additionally, `scripts/check_env.py` utilizes `shell=True` for system checks, and `scripts/download_model.sh` executes remote downloads via `curl` from ModelScope/HuggingFace, which are risky behaviors in an automated agent environment.