Voicenotes

Sync and access voice notes from Voicenotes.com. Use when the user wants to retrieve their voice recordings, transcripts, and AI summaries from Voicenotes. Supports fetching notes, syncing to markdown, and searching transcripts.

This skill appears to do what it says: call voicenotes.com API and write notes as markdown. However, the package metadata omitted required items — the scripts expect you to set VOICENOTES_TOKEN and the sync script requires jq. Before installing: (1) confirm the token is obtained from the legitimate Voicenotes settings URL and only grant the minimum-scoped token possible; (2) ensure jq is installed in the environment; (3) be aware the scripts will write files into the chosen output directory (ensure you trust that location); (4) because the skill source is 'unknown', prefer getting code from the official upstream or verifying the repository/maintainer; and (5) if you rely on automated policy checks, update the skill metadata to declare VOICENOTES_TOKEN and required binaries so installers and reviewers are not misled. These inconsistencies look like sloppy packaging rather than explicit malice, but verify the token's permissions and the upstream source before use.

Type: OpenClaw Skill Name: voicenotes Version: 1.0.0 The skill is benign. Its behavior is fully aligned with the stated purpose of syncing voice notes from Voicenotes.com. It uses `curl` to interact with the legitimate `api.voicenotes.com` endpoint, authenticating with a user-provided `VOICENOTES_TOKEN` environment variable, and writes the retrieved data to local markdown files. There is no evidence of data exfiltration to unauthorized destinations, malicious execution, persistence mechanisms, or prompt injection attempts in SKILL.md or the scripts. All network and file system operations are necessary for its described functionality.