Telegram Voice Group

向指定 Telegram 群组发送语音消息

This skill appears to implement what it claims (generate TTS, convert with ffmpeg, and send to Telegram), but there are several concerns you should address before installing or enabling it: 1) Do not blindly grant the OpenClaw bot broad admin permissions (ban/add-admins/delete). For sending voice messages, send permissions/media are enough; avoid add-admins/ban/restrict unless you fully trust the bot. 2) The index.js has a bug extracting the group ID from a session key (it uses the wrong split index) — test that group/thread addressing works and correct the code (use the correct segment index). 3) The code invokes shell commands via child_process.exec with user-provided text; this can enable command injection. Prefer execFile/spawn with argument arrays or properly escape/sanitize input. 4) The docs suggest optional web aggregation (Reddit/Twitter) and extra CLIs — if you enable those flows, be aware the skill could collect external content and post it to your groups; only enable such integrations when you understand and trust them. 5) Verify that '@openclaw/core' messaging functions behave as expected in your environment and that temporary files are handled securely. If you are uncomfortable with these issues, test the skill in an isolated environment first, or request a corrected version that fixes the groupId parsing and avoids shell interpolation of unsanitized input.

Type: OpenClaw Skill Name: telegram-voice-group Version: 0.1.5 The skill is classified as suspicious primarily due to the excessive administrative permissions recommended for the Telegram bot in SKILL.md and README.md (e.g., 'Restrict Members', 'Ban Members', 'Add Admins'). While the skill's code does not directly utilize these permissions, instructing users to grant them creates a significant security risk for the bot account if compromised. Additionally, the `send_telegram_voice.js` utility script contains a potential command injection vulnerability in its `node -e` call, where user-controlled variables are directly interpolated into a JavaScript string, which could lead to arbitrary code execution if the script's inputs are maliciously crafted.