Voice Agent

Local Voice Input/Output for Agents using the AI Voice Agent API.

This client-only skill is coherent, but before installing/using it: 1) ensure you actually run and trust the backend that must be reachable at http://localhost:8000 (the backend will handle Whisper and AWS Polly and will hold any cloud credentials); review the backend source or run it locally in an isolated environment. 2) Be aware the client uploads the audio file you specify to localhost and writes synthesized audio to the output path you provide — avoid pointing it at sensitive files or to paths where overwriting is a risk. 3) The client reads entire files into memory for upload, so very large files may cause memory pressure. 4) If you rely on production AWS credentials, ensure the backend stores and uses them securely (not this client). If you want extra assurance, inspect and run the backend code locally before connecting the skill to non-test data.

Type: OpenClaw Skill Name: voice-agent Version: 1.1.0 The `scripts/client.py` file contains critical vulnerabilities that allow for arbitrary file read and write operations. The `transcribe` function reads the content of an arbitrary file path provided as an argument and sends it to `http://localhost:8000/transcribe`. Similarly, the `synthesize` function writes the generated audio content to an arbitrary file path provided as an argument. These flaws, while not explicitly malicious in intent, enable an attacker to read sensitive local files or write arbitrary content to any location on the filesystem, posing a significant risk for data exfiltration or local privilege escalation.