whatsappVoiceOpenSkill

Real-time WhatsApp voice message processing. Transcribe voice notes to text via Whisper, detect intent, execute handlers, and send responses. Use when building conversational voice interfaces for WhatsApp. Supports English and Hindi, customizable intents (weather, status, commands), automatic language detection, and streaming responses via TTS.

What to check before installing or running this skill: - Audio format support: The README claims OGG/Opus works without FFmpeg, but transcribe.py uses soundfile/libsndfile. libsndfile often cannot read Opus-in-OGG; test with real WhatsApp files. If you see failures, add FFmpeg-based conversion or use a tool that supports Opus. - Language handling: transcribe.py forces language="en" when calling Whisper, which will hurt Hindi/other-language transcripts. The skill does language detection only after transcription. If you expect multi-language input, update transcribe.py to let Whisper detect language (or pass correct language param). - Missing/implicit dependencies: package.json lists no dependencies, yet code uses fetch (Node versions <18 may not have global fetch), and examples require drone-sdk or music-api — those are not provided. Ensure you install and pin the dependencies you actually need. - Network and device actions: built-in weather handler makes an HTTP request to wttr.in (expected). Example handlers show controlling drones or smart-home devices — these are only executed if you wire in such handlers, but be careful: adding handlers can introduce network/device access and will need appropriate credentials and safety checks. - Resource & security posture: Whisper models are large and memory- and CPU-intensive; running locally will download models and consume ~1+ GB RAM (per docs). Run in a sandboxed environment first; don’t point it at directories with sensitive files you wouldn’t want processed or uploaded. - Testing: Run the daemon in a controlled environment, feed a few sample WhatsApp voice files, and verify transcription/language detection. Inspect logs (.voice-processed.log) and ensure parent process handling of printed JSON will not leak data to unexpected endpoints. If you want, I can produce a short checklist of code fixes (e.g., remove language="en", add a fallback ffmpeg conversion, pin dependencies) and a minimal safe test plan to validate the skill in a sandbox.

Type: OpenClaw Skill Name: whatsapp-voice-chat-integration-open-source Version: 1.0.0 The skill is classified as suspicious due to the use of high-risk capabilities, specifically `child_process.execSync` in `scripts/voice-processor.js` to execute a Python script, and an external network call via `fetch` to `https://wttr.in/Delhi?format=j1` in the same file. While these actions are plausibly aligned with the skill's stated purpose (transcription and weather information), `execSync` allows arbitrary command execution, and external network calls can be a vector for data exfiltration or C2 if abused. There is no clear evidence of intentional malicious behavior, but the presence of these powerful primitives without strict sandboxing warrants a 'suspicious' classification.