voice2feishu

文字转语音并发送到飞书。支持两种模式：API 模式（智谱/OpenAI 等）和本地模式（ChatTTS）。

This skill appears to do exactly what it says: generate TTS (via a 3rd‑party API or a local ChatTTS service) and upload audio to Feishu. Before installing, consider: 1) Only provide FEISHU_APP_ID and FEISHU_APP_SECRET if you trust the skill — these allow sending messages from the app. 2) API mode sends text to whatever TTS_API_URL you configure (e.g., OpenAI or Zhipu); sensitive text will be transmitted to that provider. 3) Local mode may auto-download ~2GB model files (Hugging Face/ModelScope) and runs an unauthenticated Flask server bound to 0.0.0.0 by default — if you run it, consider binding to localhost or using a firewall to restrict access. 4) The scripts write temporary files and logs to /tmp; inspect logs at /tmp/chattts-server.log if you run the service. 5) Ensure required binaries (ffmpeg, ffprobe, jq, curl) and optional Python dependencies are installed from trusted sources. If you want more assurance, review the scripts (they are present in the package) and test in a safe environment first.

Type: OpenClaw Skill Name: voice2feishu Version: 1.0.2 The skill bundle provides functionality to convert text to speech and send it to Feishu, but it contains several significant security vulnerabilities. The scripts `api-tts.sh` and `local-tts.sh` perform unsafe string interpolation of user-provided text into JSON payloads for curl commands, which is susceptible to injection. Additionally, `chattts-server.sh` generates and executes a Python Flask server that binds to all network interfaces (0.0.0.0) without any authentication, potentially exposing the host to unauthorized remote access or resource exhaustion. While the behavior aligns with the stated purpose, these architectural flaws represent a high risk for exploitation.