Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Voice Memo

v0.1.2

Send native iMessage voice bubbles with ElevenLabs TTS via BlueBubbles. Use when: user asks to send a voice message, wants something spoken aloud, storytelli...

0· 375·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The script implements exactly what the skill describes: it calls ElevenLabs TTS, converts audio with afconvert to Opus CAF, and posts to a BlueBubbles Private API to produce native iMessage voice bubbles. Required binaries (curl, afconvert) and the two service credentials are appropriate for this functionality.
Instruction Scope
SKILL.md and the script confine actions to generating audio, converting it, and sending it to the BlueBubbles endpoint. The script sources ~/.openclaw/.env for credentials and does not attempt to read unrelated system files or exfiltrate arbitrary data. It documents how transcriptions integrate into conversation context and notes that transcriptions are not auto-persisted.
Install Mechanism
No install spec (instruction-only) and a small included shell script. No downloads, archive extraction, or third-party package installs — low install-time risk.
Credentials
The script requires ELEVENLABS_API_KEY and BLUEBUBBLES_PASSWORD (proportionate to the task). However, registry metadata at the top of the submission lists no required env vars while SKILL.md and the script do — an inconsistency. Also note the script blindly sources ~/.openclaw/.env, which may contain additional secrets; ensure that file contains only intended credentials and is protected.
Persistence & Privilege
always:false and no system-wide configuration changes. The skill can be invoked autonomously (platform default), which is expected for skills; it does not request persistent elevated privileges or modify other skills' configs.
Assessment
This skill appears to do what it claims: generate ElevenLabs TTS, convert to Opus CAF, and post to a BlueBubbles Private API to create native iMessage voice bubbles. Before installing: (1) verify the skill's source (homepage is a GitHub repo) and inspect ~/.openclaw/.env to ensure it only contains the expected ELEVENLABS_API_KEY and BLUEBUBBLES_PASSWORD; (2) ensure BLUEBUBBLES_URL points to a trusted local BlueBubbles instance (default is http://127.0.0.1:1234); (3) treat the ElevenLabs API key as billable/privileged — restrict its scope and rotate if shared; (4) be aware that if you set BLUEBUBBLES_URL to a remote endpoint, audio and metadata will be sent there (so only use trusted endpoints); and (5) note the metadata/registry inconsistency (registry omitted required env vars) — this is likely a packaging oversight but worth confirming with the author before granting credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ebx25y17fr1jn6bz4kczwes81x9rg

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎙️ Clawdis
Binscurl, afconvert

SKILL.md

Voice Memo

Send native iMessage voice bubbles (not file attachments) using ElevenLabs TTS and BlueBubbles.

Quick Start

Run the script with text and recipient:

scripts/send-voice-memo.sh "Your message here" +14169060839

This will:

  1. Generate TTS audio via ElevenLabs (Rachel voice by default)
  2. Convert to Opus CAF @ 24kHz (iMessage native format)
  3. Send as native voice bubble via BlueBubbles

Requirements

  • BlueBubbles running locally with Private API enabled
  • ElevenLabs API key (for TTS)
  • macOS (for afconvert audio conversion)
  • Environment variables in ~/.openclaw/.env:
    ELEVENLABS_API_KEY=your-key-here
    BLUEBUBBLES_PASSWORD=your-password-here
    # Optional overrides:
    ELEVENLABS_VOICE_ID=21m00Tcm4TlvDq8ikWAM  # Rachel (default)
    ELEVENLABS_MODEL_ID=eleven_turbo_v2_5      # Turbo v2.5 (default)
    

The Working Formula

Critical parameters discovered 2026-02-19:

ParameterValueWhy
chatGuidany;-;+PHONENOT iMessage;-; (causes timeouts)
methodprivate-apiRequired for native bubble
isAudioMessagetrueRequired
Audio formatOpus @ 24kHz in CAFiMessage native format
Pre-convertYesDon't let BlueBubbles convert (wrong codec)

Voice Options

Default voice: Rachel (ElevenLabs)

  • Voice ID: 21m00Tcm4TlvDq8ikWAM
  • Model: eleven_turbo_v2_5 (fast, natural)
  • Cost: ~$0.04 per 30s message

Expressive tags:

  • [laughs] — natural laughter
  • [sighs] — expressive sigh
  • [excited] — energetic delivery

Example: "[excited] Oh my god, it worked!"

For full voice list and IDs, see VOICES.md.

Bidirectional Voice Memos

Sending (Amz → Amy): Use this skill. Native voice bubbles appear with waveform UI.

Receiving (Amy → Amz): BlueBubbles auto-converts incoming voice memos to MP3. OpenClaw transcribes via Whisper. Transcribed text flows into conversation context automatically.

Memory note: Incoming voice memo transcriptions flow into conversation context like any text message. They are NOT automatically persisted to memory or files — the agent must explicitly choose to store them, same as any conversation content. If you want to prevent transcriptions from being retained, instruct the agent not to record voice memo content in memory.

Troubleshooting

Voice bubble arrives as file attachment:

  • Check method=private-api is set
  • Verify chatGuid uses any;-; prefix (not iMessage;-;)
  • Check response has "isAudioMessage": true

API times out:

  • Use any;-;+PHONE format for chatGuid
  • Verify BlueBubbles Private API is enabled
  • Restart BlueBubbles if consistently slow

Audio is 0 seconds / unplayable:

  • Ensure pre-conversion to Opus @ 24kHz
  • Don't let BlueBubbles convert (uses wrong codec)
  • Verify with: afinfo output.caf (should show opus @ 24000 Hz)

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…