(macOS) Discord voice assistant installer. Install/update discord-local-stt-tts (Discord voice, Discord local, local STT + local TTS) from GitHub Releases.

This installer largely does what it says (download a GitHub release and install it into your OpenClaw plugin folder), but be aware of two practical concerns before running it: (1) the script currently has a bug that will likely abort the install because the Python heredocs are quoted and the $LATEST_JSON path is not expanded; you can fix it by allowing variable expansion (e.g., change <<'PY' to <<PY) or call Python with the filename as an argument (python3 -c "import json,sys;print(json.load(open(sys.argv[1]))['tag_name'])" "$LATEST_JSON"). (2) If pnpm is installed, the installer will run pnpm i && pnpm build inside the downloaded repo — that executes upstream build scripts which can execute arbitrary commands on your machine. To reduce risk: inspect the repository/release contents manually before installing, run the installer in a restricted environment or VM, avoid having pnpm installed if you don't want automatic builds, or run the build step manually after reviewing package scripts. Also confirm you trust the repository owner and the GitHub release you are installing; the script downloads and extracts code from that release into your home directory (it does create a .bak backup of any existing plugin).

Type: OpenClaw Skill Name: discord-local-stt-tts-installer Version: 0.1.1 The skill downloads and installs a plugin from a GitHub repository (vilmire/discord-local-stt-tts) using `curl` and `unzip`. A significant supply chain vulnerability exists in `bin/install.sh` because it executes `pnpm i && pnpm build` on the downloaded code if `pnpm` is available. This allows for arbitrary code execution via `package.json` scripts if the upstream GitHub repository were to be compromised, making it a high-risk capability, though not inherently malicious in this skill's design.