Pocket AI Integration

Transcribe, index, and semantically search all voice recordings, extracting action items and meeting insights for comprehensive conversation intelligence.

Before installing: (1) Verify provenance — confirm the author's repo/homepage and that https://public.heypocketai.com and related domains are legitimate and match the Pocket AI product you expect. (2) Understand and control the API key: the skill reads ~/.config/pocket-ai/api_key (this was not declared in registry metadata) — keep a dedicated, least-privilege key for this integration and inspect file contents. (3) Audit the included code (pocket_api.py and search.sh) yourself — they make HTTP calls and will send transcripts/searches to the remote API. (4) Consider information flow: the docs encourage posting decisions/action-items to channels and integrating with agent heartbeats; ensure those downstream channels/systems are safe for meeting content. (5) If unsure, test in a sandboxed environment or review network traffic (or create a throwaway API key) before connecting sensitive recordings.

Type: OpenClaw Skill Name: pocket-ai Version: 1.0.1 The skill bundle provides legitimate integration with the Pocket AI service. However, the `search.sh` helper script contains a shell injection vulnerability. It directly inserts user-provided input (`$1` or `$QUERY`) into the `curl -d` argument without proper JSON or shell escaping, which could allow for arbitrary `curl` argument injection or command execution if a malicious string is passed as a query. All network communication is directed to the documented `public.heypocketai.com` endpoint, and there is no evidence of intentional data exfiltration or malicious prompt injection against the AI agent.