Telegram Multilingual Voice Reply

Smart Telegram reply workflow for OpenClaw: if the user sends text, reply with text; if the user sends a voice note/audio, transcribe locally using the insta...

This skill appears internally consistent and implements local ASR/TTS as described. Before installing or running it, make sure you: (1) install mlx_audio and ffmpeg from trusted sources and be aware those installs will likely download large model files (network + disk usage); (2) run the scripts in an environment you control (container/venv) because they will execute local binaries and create temporary files; (3) avoid passing paths to sensitive files as the scripts operate on file paths you provide; (4) note the scripts call external CLIs found on PATH or ~/.local/bin — ensure those executables are the genuine tools you intend to use to prevent accidental execution of a replaced/malicious binary. If you need the agent to run in a more restricted environment, prefer isolating execution or denying network/model downloads.

Type: OpenClaw Skill Name: telegram-multilingual-voice-reply Version: 0.1.0 The `SKILL.md` file instructs the AI agent to execute `python3` scripts (`scripts/mlx_asr.py` and `scripts/mlx_tts_voice.py`) with arguments directly derived from user input (e.g., audio file paths, language, generated reply text). This creates a significant shell injection vulnerability if the OpenClaw agent does not rigorously sanitize or escape user-controlled input when constructing and executing these shell commands. While the Python scripts themselves use `subprocess.run` with lists (generally safer), the risk lies in how the agent constructs the initial command string, which could lead to arbitrary code execution on the host system.