Security audit
Security checks across malware telemetry and agentic risk
This looks like a legitimate voice assistant, but it handles sensitive live audio and chat content with under-disclosed permissions and weak local access controls.
Review before installing. Use it only with provider accounts and an OpenClaw gateway approved for the conversations you plan to have, avoid sensitive speech unless those services are acceptable, run the server only on a trusted machine/network, and prefer fixing the metadata, missing .env.example, privacy notice, WebSocket/origin controls, and transcript rendering before broad use.
class ElevenLabsSTT:
"""STT via ElevenLabs Scribe API (REST-based, non-streaming)."""
API_URL = "https://api.elevenlabs.io/v1/speech-to-text"
def __init__(self):
self._audio_buffer = bytearray()await self._resolve_voice_id()
url = (
f"https://api.elevenlabs.io/v1/text-to-speech/{self._voice_id}/stream"
f"?output_format=pcm_16000"
)
try:async def synthesize_stream(self, text: str) -> AsyncGenerator[bytes, None]:
"""Stream audio bytes from Deepgram Aura for a given text chunk."""
url = f"https://api.deepgram.com/v1/speak?model={TTS_VOICE_DG}&encoding=linear16&sample_rate={SAMPLE_RATE}"
try:
async with httpx.AsyncClient(timeout=30.0) as client:
async with client.stream(64/64 vendors flagged this skill as clean.
No suspicious patterns detected.