Interactive AI avatar with Simli video rendering and ElevenLabs TTS

What to consider before installing: - The skill is generally consistent with an avatar frontend (Simli + ElevenLabs) but the server also connects to an OpenClaw gateway and supports Slack/email/Stream Deck integrations. Those integrations require additional environment variables (OPENCLAW_TOKEN, SLACK_BOT_TOKEN) even though the SKILL.md only lists SIMLI_API_KEY and ELEVENLABS_API_KEY. - The server writes a device-key.json (an on-disk private key) and establishes persistent WebSocket connections to the configured gateway URL. Expect a persistent process and created files in the working directory. - The code intentionally returns the Simli API key to the browser via /api/client-config. If you consider your SIMLI_API_KEY sensitive, that means the key will be exposed to any code served to the browser. Do not run this with production secrets unless you accept that exposure. - If you plan to enable Slack or email forwarding, the skill will require additional tokens; enable only with least-privilege tokens and review the relevant code paths (/api/send-slack, /api/send-email) before providing those credentials. - Installation via npm (global) installs code from the npm registry; verify the package author, repository, and integrity before trusting it. Consider running the server in an isolated environment (container, VM) and binding ports/firewalls to localhost only. - If you need to proceed, audit the server endpoints (especially /api/*), confirm where gatewayUrl points (default is ws://127.0.0.1:18789) and whether OPENCLAW_TOKEN will be used, and avoid using production credentials until you review and understand the data flows. If you want, I can: - Point out the exact lines where additional env vars are read and where simliApiKey is leaked to the client, or - Extract and summarize all server endpoints and what they expose so you can decide whether to run it.

Type: OpenClaw Skill Name: avatar Version: 1.0.0 The skill is classified as suspicious due to several high-risk capabilities, despite their stated purpose. The `src/server.ts` file performs server-side prompt injection into the AI agent, explicitly granting it 'full access to HubSpot, Gmail, Calendar, Notion, and Slack,' which represents a broad and powerful capability that could be misused if the agent itself is compromised. Additionally, `start-kiosk.sh` executes shell commands and `osascript` for GUI automation, and `src/server.ts` generates and stores a cryptographic keypair locally (`./device-key.json`) for authentication, and makes direct API calls to Slack using a bot token. While these actions are presented as necessary for the avatar's functionality, they involve significant privileges and sensitive operations without clear malicious intent in the provided code.