Plaud Unofficial Skill

Use when accessing Plaud voice recorder data (recordings, transcripts, AI summaries) - guides credential setup and provides patterns for plaud_client.py

This skill appears to be an unofficial, reverse-engineered Plaud client that generally matches its description, but exercise caution before installing or using it: - Review the included plaud_client.py yourself (it's provided) and confirm all network endpoints are the official Plaud domains you expect. The code is readable and makes direct requests to api-euc1.plaud.ai and related endpoints documented in PLAUD_API.md. - Be aware SKILL.md directs you to extract a bearer token from your browser localStorage and paste it into a plaintext .env file under the skill folder. That token is long-lived and grants access to your recordings and transcripts—only do this on a machine you control and trust. - Note the mismatch: registry metadata declares no required env vars, SKILL.md asks for PLAUD_TOKEN and PLAUD_API_DOMAIN, but plaud_client.py uses a region mapping/--region flag rather than reading PLAUD_API_DOMAIN from the environment. This likely indicates sloppy documentation rather than malicious behavior, but it is an incoherence you should confirm before trusting automation. - If you decide to proceed: restrict file permissions on the .env (chmod 600), keep backups secure, delete the token from browser/localStorage if you rotate it later, and consider creating a limited/rotatable credential if Plaud supports it. If unsure, prefer manually running the included script rather than granting the skill autonomous access.

Type: OpenClaw Skill Name: plaud-unofficial Version: 1.0.1 The skill is designed to interact with the Plaud API to manage voice recordings, transcripts, and AI summaries. The `SKILL.md` provides clear, explicit instructions for the user to obtain credentials from the Plaud web app's local storage and set them up in a local `.env` file. The `plaud_client.py` script correctly loads these credentials, makes API calls only to the expected Plaud domains (`*.plaud.ai`), and handles file downloads with basic sanitization. There is no evidence of prompt injection against the agent, data exfiltration, malicious execution, persistence mechanisms, or obfuscation. All actions are aligned with the stated purpose of accessing Plaud data.