volcengine-tts-feishu

火山引擎豆包语音合成模型2.0 TTS。支持多种音色、情感参数、SSML标记，生成高质量中文语音，支持一键发送飞书语音气泡。使用HTTP单向流式API，稳定可靠。

This skill's code implements Volcengine TTS and sending to Feishu and appears to be functional, but there are important inconsistencies you should address before installing or running it: - Credentials: The script requires your Volcengine AppID and Access Token (per-skill config ~/.openclaw/workspace/skills/volcengine-tts-feishu/config.json) and will automatically read ~/.openclaw/openclaw.json to obtain Feishu appId/appSecret. Those credentials are sensitive — confirm you trust the skill source before providing them. The registry metadata did not declare these requirements, so the omission is a red flag. - Config scope: Because the script reads ~/.openclaw/openclaw.json, it has access to whatever is stored there; inspect that file first and remove or rotate any secrets you do not want the skill to access. Prefer creating a per-skill config with only the needed values. - Dependencies: requirements.txt is incorrect (it lists websockets but the script uses requests). Before running, create and activate a virtualenv and pip-install requests and any other dependencies (pip install requests). Ensure ffmpeg and curl are available if you plan to use --send-to. - Run safely: Run the script in an isolated environment (container or VM) or with non-privileged test accounts to confirm behavior. Review the code yourself — it posts audio to Volcengine and Feishu endpoints and uses subprocesses; while that matches the stated function, it's best to audit and optionally modify the script to avoid automatic reading of ~/.openclaw/openclaw.json (or to prompt before using it). - Source provenance: The skill has unknown source and no homepage. If you need stronger assurance, request the author/publisher to declare the required config paths/env vars in the registry metadata and to fix the requirements.txt mismatch.

Type: OpenClaw Skill Name: volcengine-tts-feishu Version: 1.0.7 The skill performs Text-to-Speech synthesis and sends audio to Feishu, but exhibits several high-risk behaviors and vulnerabilities. Specifically, scripts/http_tts.py reads sensitive credentials from the global ~/.openclaw/openclaw.json file and uses subprocess.run to execute curl and ffmpeg, which are high-risk capabilities. The script is also vulnerable to path traversal as it writes to a user-provided --output path without sanitization. Furthermore, there is a discrepancy in requirements.txt, which lists 'websockets' (unused) while omitting the 'requests' library required by the script, and the use of both urllib and requests for API calls to Volcengine and Feishu is inconsistent.