Open Utter (Meeting Bot)

Headless Google Meet bot that joins meetings and captures live captions as transcripts.

This skill does what it claims, but it stores and reads sensitive local session data (Playwright storageState in ~/.openutter/auth.json and auth-meta.json) that let the bot join as your Google account without host approval. The registry metadata did not declare these config paths or the persistent credential-like file. Before installing: 1) Only use --auth (authenticated mode) if you fully trust the skill's source — otherwise prefer guest mode (--anon) so nothing stores your Google session. 2) Inspect the scripts yourself (they're included) and consider running them in an isolated VM or container. 3) If you authenticate, be aware auth.json contains cookies/localStorage; delete it when done or restrict its filesystem permissions. 4) The skill sends screenshots and messages using the local openclaw CLI when given a channel/target; confirm you want meeting screenshots/transcripts forwarded to chat. 5) If you need higher assurance, ask the publisher to declare the required config paths and explain how auth.json is protected, or prefer a skill that does not persist your Google credentials.

Type: OpenClaw Skill Name: openutter Version: 1.0.1 The skill bundle is classified as suspicious due to a shell injection vulnerability in `scripts/utter-join.ts`. The `execSync` call, which sends messages via `openclaw message send`, directly interpolates the `opts.channel` parameter without proper sanitization or JSON stringification. This allows for arbitrary command injection if a malicious actor can control the `--channel` argument (e.g., via prompt injection against the OpenClaw agent). While the skill's core functionality (Google Meet bot, caption capture, local storage of auth) aligns with its stated purpose, this vulnerability poses a significant risk for remote code execution.