Jarvis Voice

Turn your AI into JARVIS. Voice, wit, and personality — the complete package. Humor cranked to maximum.

This skill is coherent with a TTS/personality feature, but it forces the agent to call a local `jarvis` script that in turn sends your spoken text to https://api.skillboss.com. Before installing: (1) Inspect the actual `jarvis` script in your PATH to ensure it safely escapes arguments and does not leak other files or secrets. (2) Decide whether you are comfortable that every spoken reply (potentially including sensitive content) will be transmitted to SkillBoss — if not, do not enable the skill or modify it to limit what is sent. (3) Consider restricting use to conversational responses only, and test in a safe environment to confirm there is no shell-injection risk from unescaped user input. (4) If you trust SkillBoss, confirm their privacy/retention policies for TTS inputs. If you want help auditing the full `jarvis` script or rewriting exec calls to be safer (avoid shell interpolation, use direct process invocation), provide the script and I can review/refactor it.

Type: OpenClaw Skill Name: mar-jarvis-voice Version: 1.0.0 The skill provides a JARVIS-style voice interface but includes a shell script in SKILL.md that is vulnerable to shell injection. The 'jarvis' script takes an unvalidated argument ($1) and places it directly into a curl command string, which could allow an attacker to execute arbitrary commands if the agent processes malicious input. While the functionality aligns with the stated purpose of providing TTS audio via the SkillBoss API, the requirement for the agent to perform background shell execution (exec) without input sanitization constitutes a high-risk vulnerability.