Signal messaging for standalone bots/accounts

Full Signal messenger integration for OpenClaw agents. Send/receive text and voice messages via signal-cli with role-based permissions (owner/trusted/untrust...

This skill implements a full Signal bot using signal-cli and local scripts. Before installing: - Be prepared to install signal-cli, Java (OpenJDK 21+), and ffmpeg manually; the registry metadata does not list these but the SKILL.md requires them. - Keep your WAKE_URL and WAKE_TOKEN private; set WAKE_URL to your local OpenClaw endpoint where possible. If WAKE_URL points to a remote host, validate the remote endpoint — the script will trigger it when messages arrive. - Understand the permissions.json owner role: any contact you mark as owner is allowed (per the docs) to instruct the agent to execute commands and modify files. Only assign owner to accounts you fully trust. - The scripts persist full message contents and debug logs under ~/.signal-state — review and rotate or restrict access to that directory if message confidentiality matters. - If you plan to use Whisper or hosted TTS/STT, confirm whether those services are local or remote and whether API keys will be required; external STT/TTS may transmit audio to third parties. - Review the included scripts (signal-poll.sh and signal-send.sh) yourself before running, and test with a disposable Signal number if possible. If you want, I can list the exact lines that create files, call the wake hook, and persist message bodies so you can audit them quickly.

Type: OpenClaw Skill Name: signal-messenger-standalone Version: 1.0.0 The skill bundle is classified as suspicious due to critical vulnerabilities that could lead to arbitrary command execution (RCE) via shell injection and prompt injection against the OpenClaw agent. Specifically, `scripts/signal-send.sh` directly interpolates user-controlled input (`$recipient`, `$message`) into `signal-cli` commands without sanitization, creating a shell injection vulnerability. Furthermore, `scripts/signal-poll.sh` logs raw, untrusted message content from Signal users into files (`$WAKE_FILE`, `$HISTORY_DIR/*.log`) which the `SKILL.md` instructs the OpenClaw agent to read and process, posing a significant prompt injection risk to the agent's underlying LLM, despite the described role-based permission system.