feishu-audio-messages

The script's functionality (TTS -> convert -> upload -> send via Feishu Open API) matches the skill name and description. The Feishu APP ID/SECRET it uses are appropriate for this purpose. However, the registry metadata declares no required environment variables or primary credential even though the script requires FEISHU_APP_ID and FEISHU_APP_SECRET (or equivalent entries in ~/.openclaw/.env or ~/.openclaw/openclaw.json). This omission is an inconsistency in the manifest.

SKILL.md and send-voice.sh limit actions to generating/transforming audio, reading credentials (env or two ~/.openclaw paths), calling local tools (edge-tts, ffmpeg, curl, optional jq), and POSTing to open.feishu.cn endpoints. The script does not attempt to read unrelated system files, network endpoints beyond Feishu, or exfiltrate data to other hosts.

No install spec (instruction-only + an included script). Dependencies are local binaries and a pip package (edge-tts). There are no downloads or archive extraction steps in the skill itself. Risk level is low for install mechanism.

The script legitimately needs FEISHU_APP_ID and FEISHU_APP_SECRET to call Feishu APIs and looks for them in environment variables or in ~/.openclaw/.env and ~/.openclaw/openclaw.json. The skill registry, however, declares no required env/primary credential. Requiring secrets but not declaring them in metadata is a meaningful discrepancy and could lead to surprise credential access (the script will read dotfiles in the user's home).

always:false (no forced persistent presence). The skill does not modify other skills, does not attempt to persist its own credentials beyond reading them, and only creates temporary files under /tmp for conversion — behavior is proportional to its purpose.