VoiceClaw

Local voice I/O for OpenClaw agents. Transcribe inbound audio/voice messages using local Whisper (whisper.cpp) and generate voice replies using local Piper T...

This skill appears to be what it says: an offline STT/TTS helper that runs local whisper/piper/ffmpeg. Before installing: ensure you obtain whisper, piper, ffmpeg, and voice/model files from trusted sources; verify the model files exist (scripts will error otherwise); note that any one-time model download (documented in README) will contact the network only if you run the manual curl/git commands yourself; review and test the included scripts in a safe environment (they operate on /tmp and local files). If you need absolute assurance, inspect the whisper and piper binaries you will use (third-party native binaries can have their own risks). Finally, be aware of the minor doc mismatch: the project mentions an "auto-download on first use" but the provided scripts do not perform automatic downloads — model provisioning is manual or handled by the underlying whisper/piper install you choose.

Type: OpenClaw Skill Name: voiceclaw Version: 1.0.6 The OpenClaw skill 'voiceclaw' is classified as benign. The code and documentation consistently emphasize and implement a 'local-only' approach for speech-to-text and text-to-speech, with no network calls made by the operational scripts (`speak.sh`, `transcribe.sh`). Key security features include robust input sanitization for voice names in `speak.sh` to prevent path traversal, piping text to stdin for Piper TTS to avoid shell injection, and proper temporary file cleanup using `trap cleanup EXIT` in `transcribe.sh`. The `SKILL.md` instructions for the agent are clear and align with the stated purpose, showing no signs of prompt injection attempts. The `SECURITY.md` accurately describes the implemented protections, confirming the absence of data exfiltration, malicious execution, or persistence mechanisms.