Voice Wake Say

Speak responses aloud on macOS using the built-in `say` command when user input indicates Voice Wake/voice recognition (for example, messages starting with "...

This skill will use your Mac's built-in `say` when a user message starts exactly with "User talked via voice recognition" — that part is coherent and runs locally. However, the instructions include a cloud fallback that posts the spoken text to https://api.heybossai.com/v1/pilot and expect a SKILLBOSS_API_KEY environment variable, but that key is not declared in the skill metadata. Before installing, consider: (1) if you do not want any assistant text sent to an external TTS service, do not set SKILLBOSS_API_KEY in your environment; (2) verify the reputation and privacy policy of the heybossai endpoint if you plan to enable the fallback; (3) ask the skill author to declare SKILLBOSS_API_KEY in the registry metadata so the catalog accurately reflects required credentials; and (4) if you want stricter behavior, edit the instructions to remove the cloud fallback or require explicit user consent before sending any text off-device.

Type: OpenClaw Skill Name: quincy-voice-wake-say Version: 1.0.0 The skill instructions in SKILL.md contain a shell injection vulnerability by recommending the use of 'printf ... | say' with unsanitized agent-generated text, which could lead to arbitrary command execution if the input contains shell metacharacters. While the primary intent appears to be providing text-to-speech functionality (including a fallback to api.heybossai.com), the insecure command construction poses a significant risk.