Voice Log

Background voice journaling with Soniox realtime STT for OpenClaw. Requires SONIOX_API_KEY. Get/create your Soniox API key at https://soniox.com/speech-to-te...

This skill appears to do what it says: record your microphone and stream audio to Soniox STT using a SONIOX_API_KEY, keep a rolling 60-minute text log, and let you start/stop and request recent summaries. Before installing: 1) Confirm you want continuous microphone capture and trust Soniox (audio is streamed to their realtime STT service). 2) Provide a Soniox API key only if you accept that audio and derived transcripts go to Soniox. 3) Be aware npm install will fetch @soniox/node from the public registry. 4) Inspect and monitor the created .data directory for stored transcripts and logs; rotate or delete it if you need longer-term privacy. 5) Note the small inconsistencies: registry metadata omitted the SONIOX_API_KEY requirement, and the script forwards a few host env vars (PATH, HOME, audio-related vars) to the daemon despite SKILL.md saying only the Soniox key is forwarded — this is likely benign (needed for audio capture) but worth knowing. If you want higher assurance, review the full (untruncated) daemon script and run the skill in a constrained environment or sandbox first.

Type: OpenClaw Skill Name: voice-log Version: 0.1.5 The OpenClaw voice-log skill is designed for background voice journaling using Soniox STT. It demonstrates strong security practices, including explicitly limiting environment variables passed to child processes, deleting the `SONIOX_API_KEY` from the daemon's environment after use, and using `spawn` with hardcoded commands/arguments for audio capture to prevent shell injection. All data is confined to a local, hardened `.data` directory. The `SKILL.md` instructions for the AI agent are benign, focusing on controlling output and accurate reporting, with no evidence of prompt injection attempts to subvert the agent's behavior or exfiltrate data. No malicious intent or high-risk vulnerabilities were identified.