← Back to Skills Marketplace
Vapi Skill
by
Colin Lowenburg
· GitHub ↗
· v0.1.0
1555
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install vapi-skill
Description
Manage Vapi voice assistants, calls, phone numbers, tools, and webhooks via Vapi REST API or CLI commands within OpenClaw.
Usage Guidance
This skill appears to be intended for managing Vapi voice agents, which would legitimately need a VAPI_API_KEY — but the bundle is inconsistent: the manifest contains only SKILL.md, yet the docs reference a local helper script that is not included and recommend running a remote install script via curl | bash. Before installing or using this skill: 1) Confirm whether the missing helper file (skills/vapi/bin/vapi-api.mjs) should be included; ask the publisher for the full package or source. 2) Do not run curl | bash on production machines without inspecting the script; prefer installing from a vetted package or from the official GitHub release. 3) Provide the VAPI_API_KEY only via a secure gateway secret or a credentials manager — do not paste it into logs or chat. 4) If you must test, run in an isolated environment (container/VM) and inspect any downloaded scripts and the helper code. 5) Ask the skill author to update registry metadata to declare required env vars and to either include the helper script or provide exact, verifiable URLs for it. These steps will reduce risk and resolve the current inconsistencies.
Capability Analysis
Type: OpenClaw Skill
Name: vapi-skill
Version: 0.1.0
The `SKILL.md` instructs the AI agent to install the Vapi CLI using `curl -sSL https://vapi.ai/install.sh | bash`. This method of executing remote scripts directly into a shell is a significant supply chain risk, as it allows for arbitrary code execution from an external source, even if the current target domain (vapi.ai) is legitimate. Additionally, the core helper script `skills/vapi/bin/vapi-api.mjs`, which is described as handling REST API interactions, is missing from the provided files, preventing a complete security analysis of the skill's primary functionality.
Capability Assessment
Purpose & Capability
SKILL.md describes managing Vapi assistants, calls, phone numbers, tools, and webhooks — which is coherent with needing a Vapi API key. However the package metadata lacks a description and declares no required env vars or code files, while the README references a helper script (skills/vapi/bin/vapi-api.mjs) that is not present in the manifest. The absence of the promised helper file and missing description/metadata are inconsistent with the claimed capability.
Instruction Scope
Runtime instructions ask the agent/operator to supply VAPI_API_KEY, run a Node helper script (examples use skills/vapi/bin/vapi-api.mjs), and optionally install the Vapi CLI. The skill doc also instructs running external install scripts (curl -sSL https://vapi.ai/install.sh | bash). The SKILL.md therefore directs agent operators to install and run external code and to export secrets — but the bundle does not contain the referenced helper script, creating a gap between instructions and delivered artifacts.
Install Mechanism
There is no formal install spec in the package, but SKILL.md recommends installing the Vapi CLI by piping a remote install.sh from vapi.ai into bash (curl | bash). That pattern is high-risk because it runs remote code without local inspection. The skill also refers to a local Node helper that is not present in the skill bundle, so it's unclear whether users are expected to fetch code from external locations.
Credentials
The registry metadata lists no required env vars, yet SKILL.md clearly requires a VAPI_API_KEY (and optionally VAPI_MODE). Requesting a single API key is proportionate to the stated functionality; the problem is the metadata/manifest failing to declare that secret and the skill instructing users to place secrets in their shell or gateway. This mismatch is an incoherence that could lead to unexpected secret handling.
Persistence & Privilege
The skill does not request persistent presence (always:false) and does not declare modifications to other skills or system-wide settings. It does instruct users to store the API key as an env var or gateway secret, which is normal for an API-integration skill.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install vapi-skill - After installation, invoke the skill by name or use
/vapi-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
vapi-skill 0.1.0
- Initial release providing management of Vapi voice agents (assistants), calls, phone numbers, tools, and webhooks via OpenClaw.
- Supports both Vapi REST API and Vapi CLI for flexible workflows.
- Includes a Node-based helper script for REST interactions.
- Offers detailed setup and usage guidance for API keys, endpoints, and deployment modes.
- Documents best practices for agent queries and resource management.
Metadata
Frequently Asked Questions
What is Vapi Skill?
Manage Vapi voice assistants, calls, phone numbers, tools, and webhooks via Vapi REST API or CLI commands within OpenClaw. It is an AI Agent Skill for Claude Code / OpenClaw, with 1555 downloads so far.
How do I install Vapi Skill?
Run "/install vapi-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Vapi Skill free?
Yes, Vapi Skill is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Vapi Skill support?
Vapi Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Vapi Skill?
It is built and maintained by Colin Lowenburg (@colygon); the current version is v0.1.0.
More Skills