Wecom Voice

Send native voice messages to WeCom using Windows TTS. Converts text to speech and sends as voice message (not audio file).

This skill appears to do what it says (generate Windows TTS → convert → send via your OpenClaw CLI), but there are a few inconsistencies you should consider before installing or running it: - The script will execute a temporary PowerShell script (created under ~/.openclaw/media/inbound) and run ffmpeg and the openclaw CLI on your machine. Review the code and be comfortable with those actions. - The SKILL.md claims FFmpeg should be in PATH, but the code uses a hardcoded FFMPEG path under AppData/WinGet. If that path doesn't exist, the conversion will fail. Consider editing the script to use ffmpeg from PATH or make the ffmpeg path configurable. - The script calls 'openclaw message send' — it relies on your existing OpenClaw CLI configuration/credentials. Ensure you trust the CLI configuration and the target recipient before allowing the skill to run. If you want this skill but are cautious: manually inspect or run the script in a controlled environment (or modify it to use ffmpeg from PATH and to log less or prompt before sending). If the script started contacting unknown network endpoints, requested unrelated credentials, or attempted to read other user files, the assessment would be more severe.

Type: OpenClaw Skill Name: wecom-voice Version: 1.0.0 The skill contains multiple command injection vulnerabilities in `scripts/send-voice.cjs`. It unsafely interpolates user-provided arguments (`text` and `targetUser`) into shell commands and a PowerShell script executed with `-ExecutionPolicy Bypass`. While the script's logic aligns with its stated purpose of sending WeCom voice messages, the lack of input sanitization allows for arbitrary code execution. No clear evidence of intentional malice or data exfiltration was found, but the implementation is highly insecure.