VoiceMonkey

Control Alexa devices via VoiceMonkey API v2 - make announcements, trigger routines, start flows, and display media.

This skill appears to do what it says: it uses a single VoiceMonkey API token to call VoiceMonkey endpoints to announce messages, trigger routines, start flows, and display media on Echo devices. Before installing, consider: (1) the VOICEMONKEY_TOKEN is powerful — anyone with it can control your Echo/Alexa devices, so only provide a token you trust the skill with; (2) the SKILL.md suggests storing the token in ~/.clawdbot/clawdbot.json — keep that file protected (restrict file permissions) or prefer setting the token as an environment variable; (3) because the agent can invoke the skill autonomously (default), review agent policies or prompts that could cause unintended announcements/triggers. If you need more assurance, ask the skill author for a privacy/security statement or request the skill be implemented as an explicit, non-autonomous action.

Type: OpenClaw Skill Name: voicemonkey Version: 1.0.0 The OpenClaw AgentSkills skill bundle for VoiceMonkey is benign. The `SKILL.md` file provides clear instructions and `curl` examples for interacting with the VoiceMonkey API, which is its stated purpose. It requires a `VOICEMONKEY_TOKEN` for authentication, which is standard for API-based skills. There is no evidence of data exfiltration, malicious execution (e.g., `curl|bash`), persistence mechanisms, or prompt injection attempts against the agent within the skill's definition. While the API allows displaying arbitrary URLs for images, videos, or websites, the skill itself uses `example.com` placeholders and does not instruct the agent to use malicious URLs or perform any harmful actions.