XunFei Voice Reply

语音回复技能 - 使用讯飞 TTS 生成语音并发送到飞书。当需要用语音回复用户消息时使用。触发词：用语音、语音回复、切换语音模式、语音模式。

This skill appears to implement Xunfei TTS correctly, but review these before installing: - Metadata mismatch: the registry claims no env vars required but SKILL.md and the code require XUNFEI_APP_ID, XUNFEI_API_KEY, and XUNFEI_API_SECRET. Don't proceed unless you're prepared to provide those secrets and trust the skill's author. Use least-privilege credentials and rotate them if possible. - Workspace edits: the skill expects the agent or you to edit USER.md (to store reply mode) and AGENTS.md (to add the voice flow). Confirm you want those persistent changes in your workspace. - Dependencies: you must install ffmpeg and the npm 'ws' package; ensure ffmpeg on your system is from a trusted source. - Shell use: the code uses child_process.execSync with interpolated file paths when calling ffmpeg. Although paths are internal (/tmp/openclaw) and not user-supplied, unquoted interpolation increases risk. Review the code and consider sanitizing/quoting paths if you run untrusted inputs. If you decide to install: (1) inspect the code yourself or run in an isolated/test environment first, (2) supply Xunfei credentials via a secure mechanism, and (3) limit exposure of those credentials to the minimum required.

Type: OpenClaw Skill Name: xunfei-voice-reply Version: 1.0.0 The skill provides legitimate text-to-speech (TTS) functionality using the Xunfei WebSocket API and ffmpeg for audio conversion. It follows standard OpenClaw patterns, such as using /tmp/openclaw for temporary files and updating USER.md to persist user preferences (text vs. voice mode). While it uses execSync to call ffmpeg, the arguments are derived from internal paths and configuration values rather than direct user input, and the text to be synthesized is safely base64-encoded before being sent to the API.