将音频文件转换为飞书可播放的语音消息。先用 ffmpeg 转为 opus 格式，再上传到飞书，最后发送 audio 消息。适用于用户想要在飞书中收到可播放的语音消息的场景。

This skill appears to do what it says (convert a local audio file and send it to Feishu), but exercise caution because the registry metadata omits required credentials and binaries. Before installing or running: (1) inspect the included script (scripts/send_audio.sh) — it uploads files to https://open.feishu.cn and uses FEISHU_APP_ID/FEISHU_APP_SECRET; (2) do not supply production credentials until you trust the source; create a test Feishu app with minimal permissions (im:message, im:message:send_as_bot) and use those; (3) ensure required tools are installed (ffmpeg/ffprobe, jq, curl) — SKILL.md only mentions ffmpeg; (4) run in an isolated/test environment first and rotate any keys used for testing; (5) if you plan to use this long-term, ask the publisher to correct the registry metadata to declare required env vars and binaries. These inconsistencies look like sloppy packaging rather than overtly malicious behavior, but they increase risk and warrant verification.

Type: OpenClaw Skill Name: feishu-audio Version: 1.0.1 The skill bundle is classified as suspicious due to a shell injection vulnerability in `scripts/send_audio.sh`. The script directly embeds user-controlled input (`$AUDIO_FILE` and `$OPUS_FILE`) into `ffmpeg` and `ffprobe` commands without proper sanitization or quoting. This flaw could allow an attacker to inject arbitrary shell commands if they can control the audio file path provided to the script, potentially leading to remote code execution. While there is no clear evidence of intentional malicious behavior (e.g., data exfiltration to unauthorized endpoints, backdoors), this vulnerability represents a significant security risk.