← 返回 Skills 市场

Feishu Audio Message

Name: Feishu Audio Message
Author: kylinr

作者 Rong · GitHub ↗ · v1.1.0

cross-platform ⚠ suspicious

654

总下载

当前安装

版本数

在 OpenClaw 中安装

/install feishu-audio-msg

功能描述

Send TTS audio as a proper playable audio message (not file attachment) to Feishu chats. Use when asked to send voice messages, TTS audio, speech announcemen...

使用说明 (SKILL.md)

feishu-audio

Send TTS audio to Feishu as a playable audio message (msg_type=audio), not a file attachment.

Why This Skill Exists

OpenClaw's message tool sends audio as a generic file. Feishu requires a two-step API flow to display it as a playable voice message:

Upload with file_type=opus
Send with msg_type=audio

Quick Usage

bash /root/.openclaw/skills/feishu-audio/scripts/send_audio.sh \
  "要说的内容" \
  "\x3Cchat_id or user open_id>" \
  [voice]          # optional, default: zh-CN-XiaoyiNeural

receive_id_type is always chat_id. For group chats use oc_xxx; for DMs use ou_xxx (open_id).

Common Voices

Language	Voice
Chinese (F)	`zh-CN-XiaoyiNeural` (default)
Chinese (M)	`zh-CN-YunxiNeural`
English (F)	`en-US-AriaNeural`
English (M)	`en-US-GuyNeural`

Credentials

Auto-read from /root/.openclaw/openclaw.json → channels.feishu.accounts.main. No manual setup needed in standard OpenClaw deployments.

Two-Step API Flow (for custom integrations)

# Step 1: Upload (file_type=opus is required regardless of actual format)
curl -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_type=opus" -F "file_name=voice.opus" -F "[email protected]"
# → returns file_key

# Step 2: Send (msg_type=audio, NOT file)
curl -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"receive_id":"oc_xxx","msg_type":"audio","content":"{\"file_key\":\"...\"}"}'

Key pitfalls:

file_type must be opus (not mp3) or upload returns 234001
msg_type must be audio (not file) or it shows as attachment

安全使用建议

This skill appears to do what it claims (generate/send Feishu audio messages), but the package metadata underreports what the script actually uses. Before installing: 1) Inspect /root/.openclaw/openclaw.json yourself — it will be read for Feishu creds; ensure you are comfortable with the skill reading that file or set FEISHU_APP_ID and FEISHU_APP_SECRET ENV vars instead. 2) Verify the presence and trustworthiness of the TTS binary (/app/openclaw/node_modules/.bin/node-edge-tts) and confirm you have curl and python3 available. 3) Ask the publisher to update metadata to declare required env vars and binaries so the skill's requirements are transparent. 4) If you require stronger isolation, run the script in a sandbox/container or create a dedicated Feishu account with limited permissions. If you cannot confirm these items, consider this skill suspicious and avoid installing it on sensitive hosts.

功能分析

Type: OpenClaw Skill Name: feishu-audio-msg Version: 1.1.0 The skill contains a shell injection vulnerability in `scripts/send_audio.sh` due to the unquoted use of the `$VOICE` variable within a subshell command (`$(echo $VOICE | cut ...)`). This could allow arbitrary command execution if an attacker successfully uses prompt injection to influence the voice parameter. While the script's logic is aligned with its stated purpose of sending TTS audio to Feishu and it correctly uses official Feishu API endpoints (open.feishu.cn), the lack of input sanitization for shell-executed variables constitutes a high-risk vulnerability.

能力评估

ℹ Purpose & Capability

The skill's described purpose (send TTS audio as msg_type=audio to Feishu) matches the included script behavior. However the package metadata declares no required environment variables or binaries while the script clearly expects FEISHU_APP_ID/FEISHU_APP_SECRET (or to read /root/.openclaw/openclaw.json) and relies on curl, python3, and a local TTS binary (/app/openclaw/node_modules/.bin/node-edge-tts). The missing declarations are an inconsistency.

✓ Instruction Scope

SKILL.md and the script stay on-task: generate or accept audio, obtain a Feishu tenant token, upload with file_type=opus, and send msg_type=audio. The only notable instruction is to auto-read /root/.openclaw/openclaw.json for Feishu credentials, which is consistent with OpenClaw deployments but is a privileged read of a config file.

✓ Install Mechanism

No install spec (instruction-only + script) — nothing is downloaded or written by an installer. The script is bundled with the skill; there is no external install URL or archive to evaluate.

⚠ Credentials

The script requires Feishu app credentials (FEISHU_APP_ID and FEISHU_APP_SECRET) and will attempt to read them from /root/.openclaw/openclaw.json if env vars are not set. The skill metadata, however, lists no required env vars or primary credential. Reading a root-level OpenClaw config file can expose other channel credentials if the config structure differs; the TTS binary path (/app/openclaw/node_modules/.bin/node-edge-tts) and use of system tools (curl, python3) are not declared either. These omissions reduce transparency about what secrets and system tools the skill accesses.

✓ Persistence & Privilege

The skill does not request persistent or always-on privileges (always:false) and does not modify other skills or system-wide settings. It runs when invoked and cleans up temp files.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install feishu-audio-msg
安装完成后，直接呼叫该 Skill 的名称或使用 /feishu-audio-msg 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.1.0

Add --transcript mode: sends audio bubble + transcript as thread reply. Add --file mode for existing audio files.

v1.0.0

Send TTS audio as playable voice message to Feishu (not file). Two-step API: upload with file_type=opus, send with msg_type=audio.

元数据

Slug feishu-audio-msg

版本 1.1.0

许可证 —

累计安装 4

当前安装数 4

历史版本数 2

常见问题