Vapi Skill

Manage Vapi voice assistants, calls, phone numbers, tools, and webhooks via Vapi REST API or CLI commands within OpenClaw.

This skill appears to be intended for managing Vapi voice agents, which would legitimately need a VAPI_API_KEY — but the bundle is inconsistent: the manifest contains only SKILL.md, yet the docs reference a local helper script that is not included and recommend running a remote install script via curl | bash. Before installing or using this skill: 1) Confirm whether the missing helper file (skills/vapi/bin/vapi-api.mjs) should be included; ask the publisher for the full package or source. 2) Do not run curl | bash on production machines without inspecting the script; prefer installing from a vetted package or from the official GitHub release. 3) Provide the VAPI_API_KEY only via a secure gateway secret or a credentials manager — do not paste it into logs or chat. 4) If you must test, run in an isolated environment (container/VM) and inspect any downloaded scripts and the helper code. 5) Ask the skill author to update registry metadata to declare required env vars and to either include the helper script or provide exact, verifiable URLs for it. These steps will reduce risk and resolve the current inconsistencies.

Type: OpenClaw Skill Name: vapi-skill Version: 0.1.0 The `SKILL.md` instructs the AI agent to install the Vapi CLI using `curl -sSL https://vapi.ai/install.sh | bash`. This method of executing remote scripts directly into a shell is a significant supply chain risk, as it allows for arbitrary code execution from an external source, even if the current target domain (vapi.ai) is legitimate. Additionally, the core helper script `skills/vapi/bin/vapi-api.mjs`, which is described as handling REST API interactions, is missing from the provided files, preventing a complete security analysis of the skill's primary functionality.