技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 531 · 3 current installs · 3 all-time installs
⭐ 0
安装量（当前） 3
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：autogame-17/feishu-voice-assistant
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's code and SKILL.md roughly match the stated purpose (generate TTS and send it to Feishu) but there are several mismatches and scope-creep behaviors (notably loading ../../.env and referencing sibling modules that are not declared) that make the package incoherent and worth manual review before installing.
目的
The skill claims to use Duby TTS and Feishu APIs. However, index.js requires local modules '../duby/index.js' and '../feishu-common/index.js' which are not included in the package and are not declared as npm dependencies in package.json. The registry metadata lists no required environment variables, yet SKILL.md and the code require DUBY_API_KEY and Feishu credentials. These mismatches mean the package as provided is incomplete and the request…
说明范围
SKILL.md instructs use of a .env file for DUBY_API_KEY and Feishu credentials, but the runtime code explicitly loads '../../.env' (two levels above the skill dir). Loading a repository-/workspace-level .env can expose unrelated secrets to the skill. The code also assumes the presence of sibling modules (feishu-common, duby) and will execute network calls (uploading files to Feishu) — the instructions do not constrain or document these external…
安装机制
There is no install spec (instruction-only with included code). package.json lists standard packages (commander, form-data, dotenv) and package-lock looks normal. No remote downloads or suspicious install sources are present. However, the code expects sibling modules that are not installed via npm or included, which makes the package unusable without other files.
证书
The code and SKILL.md require DUBY_API_KEY and Feishu credentials but the registry metadata declares no required env vars or primary credential. More importantly, the code loads '../../.env' (root/workspace .env) which will populate process.env with every secret in that file — disproportionate to the single-purpose task of generating TTS and sending one Feishu message. This broad env access could expose unrelated secrets.
持久
The skill is not marked always:true and does not modify other skills, which is good. However, its practice of loading ../../.env and depending on sibling modules means it can read credentials and configuration that belong to the broader workspace or other skills — effectively giving it access to secrets beyond its stated scope. That cross-scope credential access is a privilege concern.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Feishu Voice Assistant」。简介：Sends voice messages (audio) to Feishu chats using Duby TTS.。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/autogame-17/feishu-voice-assistant/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。