Voice Listener

智能唤醒“小龙虾”，启用百度高准确度语音识别，持续监听并自动输入语音内容，支持“停止”暂停输入。

This skill appears to do exactly what it claims: listen to your microphone, call Baidu's speech APIs using credentials you provide in baidu_config.json, and paste recognized text into wherever the cursor is. Before installing or running it: 1) Only provide your Baidu APP_ID/API_KEY/SECRET_KEY if you trust the code and (preferably) run it locally in a controlled environment. 2) Be aware it will simulate Ctrl+V keystrokes — do not run it while sensitive forms or password fields are focused. 3) The repository lists dependencies (sounddevice, numpy, keyboard, pyperclip, requests) but does not auto-install them; install them from trusted sources. 4) The script writes temporary WAV files (deleted), and sends audio to Baidu's official endpoints (token and vop.server_api). 5) If you need higher assurance, review the full voice_input_baidu_smart.py file yourself and run it in a sandboxed account or VM first. If you want me to, I can list the exact commands to install the dependencies and run the skill in an isolated environment.

Type: OpenClaw Skill Name: voice-listener Version: 0.1.0 The skill bundle implements a voice-to-text assistant using the Baidu Speech API. It is classified as suspicious because it utilizes several high-risk capabilities, including microphone recording (sounddevice), clipboard access (pyperclip), and keyboard simulation (keyboard) to inject recognized text into the active window. While these are necessary for the stated functionality, the direct injection of unsanitized strings from an external API into the keyboard buffer presents a potential risk for accidental command execution. Furthermore, the scripts contain hardcoded local environment paths (e.g., referencing 'C:\Users\11666' in voice_input_baidu_smart.py and skill.json), which is a security anti-pattern, though no evidence of intentional malice or unauthorized data exfiltration was identified.