Voice Agent Pro

Gives any OpenClaw agent a complete voice layer via ElevenLabs. Clones the principal's voice from audio samples, converts any text to MP3 audio (VSL, podcast...

This skill can do what it says (clone voices, generate TTS, place calls) but there are red flags you should address before installing: - Resolve the metadata mismatch: the registry lists NO required env vars but SKILL.md requests ELEVENLABS_*, TWILIO_*, and TELEGRAM_* — assume those credentials are needed and treat them as sensitive. - Do NOT let the skill or agent write credentials into your host-wide .env or other global config unless you understand the impact. Prefer creating dedicated, limited-scope API keys and store them in a separate, isolated config for this skill. - Avoid enabling the 'virtual-desktop' automated path unless you trust the virtual-desktop skill and accept that the agent may access an active browser session (this can expose Google sessions and other credentials). - Test in an isolated environment (throwaway container/VPS) first. Use temporary API keys, restrict Twilio numbers and callback URLs, and monitor network traffic. - Review the included voice_generator.py and any Twilio/Telegram integration code (the repository contains code) to confirm it only calls expected endpoints and that logs/audits do not leak sensitive inputs. - If you plan to make calls, check legal/compliance implications for cloned voices and automated calling in your jurisdiction; ensure consent and opt-out handling. If you cannot validate the above, treat this skill as high-risk and consider alternative, officially supported integrations or keep it disabled until you can audit and scope its permissions.

Type: OpenClaw Skill Name: voice-agent-pro-v1 Version: 1.0.7 The voice-agent-pro-v3 skill provides a legitimate voice layer for OpenClaw agents, enabling voice cloning, text-to-speech, and automated calling via ElevenLabs and Twilio. The bundle includes a well-structured Python CLI (voice_generator.py) that handles API interactions and local file management securely, avoiding shell injection vulnerabilities. While the SKILL.md instructions include high-privilege setup steps like automated browser navigation for API key retrieval and system-level package installation, these are transparently documented as necessary configuration paths for the stated functionality. No evidence of malicious intent, unauthorized data exfiltration, or hidden backdoors was found.