Wyoming Clawdbot

Wyoming Protocol bridge for Home Assistant voice assistant integration with Clawdbot.

This package appears to implement the advertised Wyoming→Clawdbot bridge, but there are a few issues to consider before installing: - The code calls a local 'clawdbot' CLI; make sure you have that CLI installed and understand its security model. The skill metadata did not declare this required binary. - docker-compose.yml mounts ${HOME}/.clawdbot into the container. That directory likely contains your Clawdbot credentials/tokens — mounting it into a container gives the container full access to those secrets. Only do this if you trust the code and the runtime environment. - The compose file specifies 'build: .' but the repository in the package does not include a Dockerfile (manifest shows none). The provided Docker instructions may fail; you may need to run the Python script directly in a venv instead. - The service binds to 0.0.0.0 and uses host networking, exposing the Wyoming service on your LAN/host. Consider firewall rules or binding to localhost if you only want local access. If you want to proceed, inspect the cloned repository yourself (or the upstream GitHub repo), verify the Dockerfile/build context before running containers, and examine the contents of ~/.clawdbot to understand what secrets will be exposed. If you do not trust the upstream source, run the Python script in a restricted environment (non-privileged user, no sensitive mounts) or avoid mounting your home config into the container.

Type: OpenClaw Skill Name: wyoming-clawdbot Version: 1.0.2 The skill is classified as suspicious due to several high-risk capabilities, despite lacking clear evidence of intentional malicious behavior. The `docker-compose.yml` file uses `network_mode: host`, granting the container full access to the host's network stack, and mounts `${HOME}/.clawdbot` from the host, exposing potentially sensitive configuration or credentials. Additionally, the `wyoming_clawdbot.py` script executes the `clawdbot` CLI tool using `asyncio.create_subprocess_exec` with user-controlled input (`transcript.text`), which, while implemented to mitigate direct shell injection, still represents a potential command injection vector if the `clawdbot` executable itself is vulnerable. These capabilities, while potentially necessary for the stated purpose, introduce significant security risks.