Voice messaging setup

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:43 AM UTC
• Version:
  1.0.3

Overview

This skill does what it says: it sets up local speech-to-text and Edge-based text-to-speech for OpenClaw voice messages, with a privacy note for cloud TTS use.

Install this if you are comfortable with faster-whisper downloading packages/models locally and with generated voice-reply text being synthesized through Edge/Microsoft TTS. For sensitive conversations, disable automatic TTS or use a local TTS provider if available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill enables automatic Edge TTS replies but does not clearly disclose that reply text may be sent to an external Microsoft/Bing-backed network service for synthesis. This creates a real privacy and data-handling risk because users may unknowingly transmit message content off-host when voice replies are enabled.

VirusTotal

65/65 vendors flagged this skill as clean.