Video Chat With Me

Real-time AI video chat that routes through your OpenClaw agent. Uses Groq Whisper (cloud STT), edge-tts (cloud TTS via Microsoft), and OpenClaw chatCompletions API for conversation. Your agent sees your camera, hears your voice, and responds with its own personality and memory. Requires: GROQ_API_KEY for speech recognition. Reads ~/.openclaw/openclaw.json for gateway port and auth token. Data flows: audio → Groq cloud (STT), TTS text → Microsoft cloud (edge-tts), camera frames (base64) + text → OpenClaw gateway → your configured LLM provider (may be cloud — frames leave the machine if using a cloud LLM). Installs a persistent launchd service (optional). Trigger phrases: "video chat", "voice call", "call me", "视频一下", "语音", "打电话给我", "我要和你视频", "videochat-withme".

This skill's functionality matches its description, but it carries elevated privacy and privilege implications. Before installing: 1) Note the source is unknown and there's no homepage—exercise caution. 2) Review server.py and setup.sh yourself (they are included) — verify exactly how the OpenClaw gateway token is read/used. 3) Understand that the skill reads your GROQ key and the OpenClaw gateway auth token (from ~/.openclaw/openclaw.json) — that gateway token grants access to the agent's memory/tools and can route frames to cloud LLMs. 4) If you install, consider running without the LaunchAgent first (use start.sh directly) and test locally, or run in a sandboxed account/container. 5) If you require privacy: configure your OpenClaw gateway to use a local/self‑hosted model (so frames don’t leave your machine), or do not provide the gateway auth in the config. 6) If you’re not comfortable auditing or trusting the author, do not install. Rotating credentials after removal and checking /tmp/videochat-withme.log and the created LaunchAgent plist are good post‑install checks.

Type: OpenClaw Skill Name: videochat-withme Version: 1.1.0 The skill is classified as suspicious due to several high-risk capabilities, primarily the installation of a persistent launchd service (`com.openclaw.videochat-withme.plist`) via `scripts/setup.sh` and the use of `subprocess.run` for `ffmpeg` and `edge-tts` in `scripts/server.py`. While these actions are documented and necessary for the skill's stated purpose (real-time video chat), the persistent service grants the skill continuous execution, and the `subprocess.run` calls, especially with LLM-generated text as input to `edge-tts`, present a potential Remote Code Execution (RCE) vulnerability if not robustly sanitized against shell injection. Data exfiltration to Groq (STT) and Microsoft (TTS) cloud services, and potentially to a user-configured cloud LLM, is also present but explicitly documented.