rupali

Playful virtual girlfriend voice companion. Use when the user wants short, flirty, friendly text replies returned as Bulbul v3 audio across chat channels (Discord/Telegram/WhatsApp). Generate a brief response, then synthesize and send MP3.

Key things to check before installing or enabling this skill: - The script requires SARVAM_API_KEY (used as 'api-subscription-key') but the registry metadata did not declare any required env vars — confirm this and update metadata before trusting the skill. - The skill will send every synthesized text to api.sarvam.ai; do not send sensitive or personal data (passwords, private messages, PII) because it will be transmitted to the TTS provider. - Verify the Sarvam service (https://api.sarvam.ai) is legitimate and that the API key can be scoped or revoked; prefer creating a limited key for this purpose. - The bundle uses Python's requests library but does not declare dependencies or an install step — ensure the runtime environment has required packages, or run the code in an isolated sandbox. - The skill source and homepage are unknown; prefer skills with a verifiable author, homepage, or source repo. If you must use it, run in a restricted account/container and monitor network requests and API key usage. - Ask the author (or require an updated package) to: declare SARVAM_API_KEY in registry metadata, list required Python deps, and document what data is sent to the TTS API and retention policy. If you cannot verify these points, treat the skill as untrusted and avoid providing real user/private data to it.

Type: OpenClaw Skill Name: openclaw-sarvam-girlfriend Version: 1.0.0 The skill bundle is benign. The `SKILL.md` clearly outlines the purpose of a virtual girlfriend voice companion and instructs the AI agent to use `scripts/bulbul_tts.py` to synthesize audio. The Python script `scripts/bulbul_tts.py` legitimately retrieves a `SARVAM_API_KEY` from environment variables and uses it to make a POST request to `https://api.sarvam.ai/text-to-speech/stream`, saving the audio response to a local file. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's intended behavior beyond its stated purpose.