Voice Agent Builder Pro

Build and manage Voice AI agents using Vapi, Bland.ai, or Retell. Create agents, configure voices, set prompts, make outbound calls, and retrieve transcripts...

This package is essentially a Vapi API client and needs only your VAPI_API_KEY — that part is coherent. However: (1) SKILL.md overstates support for Bland.ai/Retell and documents commands (like create-kb) that aren't implemented in the shipped script; treat those claims as marketing, not functionality. (2) Several example commands (import-phone) show you passing third-party credentials (Twilio SID/AuthToken) on the command line — the script will send those values to api.vapi.ai. Only provide such secrets if you trust Vapi and the skill author (agxntsix.ai). (3) If you plan to use this in production, verify Vapi's security/BAA/compliance for any sensitive data (PHI/PCI), and consider using short‑lived or limited-scope credentials when possible. (4) If you need Bland.ai or Retell support, expect to supply separate, official integrations rather than relying on this skill. (5) To reduce risk: run the script in an isolated environment, monitor network calls (to ensure they go to the documented api.vapi.ai endpoint), and inspect or test with non-production credentials before supplying real accounts.

Type: OpenClaw Skill Name: voice-agent-pro Version: 1.0.0 The skill bundle is designed to interact with the Vapi.ai API for managing voice AI agents. All code and documentation align with this stated purpose. The `scripts/vapi_agent.py` script correctly uses environment variables for API keys and makes legitimate API calls to `https://api.vapi.ai`. While it handles sensitive credentials (like Twilio API keys) for importing phone numbers, this is part of its intended functionality and these are passed directly to the Vapi API, not exfiltrated. The `SKILL.md` provides clear instructions without any prompt injection attempts or malicious directives. There are no signs of data exfiltration to unauthorized endpoints, persistence mechanisms, or obfuscation. The direct use of `json.loads` on command-line arguments in `vapi_agent.py` could be a vulnerability if the calling environment (e.g., the OpenClaw agent) does not sanitize user input, but this is a vulnerability in the calling context rather than malicious intent within the skill itself.