Openclaw Voice Gpt Realtime

• Analyzed: May 17, 2026, 4:08 AM
• Findings: 1
• Version: 0.1.4
• Hash: 5532e1c5406d379bf061394be79d7b5375f202f2b45fade4711edd03025127c7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw Voice GPT Realtime skill bundle is classified as benign due to its robust implementation of security controls and clear alignment with its stated purpose. Key indicators include strong prompt injection defenses via non-overridable `SAFETY_GUARDRAILS` and prompt sanitization in `src/prompts.ts`, comprehensive SSRF protection by strictly validating `publicUrl` to public HTTPS origins in `src/public-url.ts` and `src/config.ts`, and secure authentication for Twilio webhooks (`X-Twilio-Signature`) and WebSocket streams (per-call tokens) in `src/server.ts`. Additionally, sensitive data is handled securely with restrictive file permissions for local artifacts and masked SIDs, and all inputs are rigorously validated using Zod schemas. No evidence of intentional malicious behavior, such as data exfiltration to unauthorized endpoints or arbitrary code execution, was found.