Ningyao Voice Launcher

Install and configure a local browser-based Chinese voice chat launcher with the Ning Yao persona, including one-click Windows launchers, browser speech I/O,...

What to check before installing or running: - Treat this as code you run locally: inspect server.js before running. Pay attention to the terminal endpoint and file-read logic. The current code disallows '..' and shell metacharacters but does NOT prevent absolute paths; patch matchAllowedCommand to resolve and ensure requested files are inside the workspace directory (use path.resolve and verify startsWith workspaceDir). - Do NOT supply an organizational or high-privilege OpenAI key. Use a dedicated, limited-scope key or test account because chat and screen images are sent to the model provider. - If you enable screen capture, assume the images will be transmitted to the configured OpenAI-compatible endpoint. Avoid sharing sensitive screens. - Fix the metadata: the skill registry entry should declare OPENAI_API_KEY (and any other required env vars). The mismatch between metadata and SKILL.md is confusing and should be corrected. - Consider running the server in an isolated environment (VM/container) until you are confident. Run npm install in a controlled environment and review dependencies (express, openai are expected). - Consider removing or editing the publish-clawhub.mjs file: it references absolute local paths and local file system tooling — harmless if not executed but odd in a distributed package. If you want, I can produce a small patch for server.js to safely constrain terminal 'type' to workspaceDir (resolve path and block absolute paths), and a checklist of environment variables to add to package metadata.

Type: OpenClaw Skill Name: ningyao-voice-launcher Version: 0.1.0 The bundle provides a local voice chat application with a 'safe terminal' feature in `server.js` that is vulnerable to command injection. The `/api/terminal` endpoint uses `cmd /c` to execute commands, and while it employs a whitelist/blacklist, the sanitization for the `type` command is insufficient to prevent all forms of shell metacharacter exploitation. Furthermore, `SKILL.md` instructs the AI agent to perform high-risk administrative tasks, such as executing a PowerShell script (`scripts/install-launcher.ps1`) with `ExecutionPolicy Bypass`. While these features appear intended for a developer utility rather than being explicitly malicious, the combination of RCE vulnerabilities and high-privilege execution instructions warrants a suspicious classification.