Telnyx Stt

Transcribe audio files to text using Telnyx Speech-to-Text API. Use when you need to convert audio recordings, voice messages, or spoken content to text.

This skill is coherent with its stated purpose, but review these practical points before installing: (1) the script will send the audio file and your TELNYX_API_KEY to Telnyx's API — only use it with audio you are allowed to transmit and with a key you trust. (2) The source is 'unknown' — consider rotating the API key after first use and run the script in an isolated environment if you have strong privacy concerns. (3) The implementation manually constructs multipart payloads (works but is simple); for production use you may prefer an official SDK. (4) If you need auditability or to avoid transmitting sensitive audio, do not use this skill or sanitize data before sending.

Type: OpenClaw Skill Name: telnyx-stt Version: 1.0.1 The skill is classified as suspicious due to an arbitrary file read vulnerability in `scripts/telnyx-stt.py`. The script takes an `audio_path` as input and reads its content without validation, then sends it to the legitimate Telnyx API. While the script's intent is to process audio, an attacker could exploit this by providing a path to a sensitive file (e.g., `/etc/passwd`, `~/.ssh/id_rsa`), causing its contents to be read and transmitted to `https://api.telnyx.com`. This constitutes a significant data exposure risk, even if not directly exfiltrated to an attacker-controlled server, but lacks clear evidence of intentional malicious behavior by the skill's author.