Telegram Voice To Voice Macos

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can send generated voice replies in Telegram on the user's behalf when this workflow is used.

Why it was flagged

The skill instructs the agent to send generated audio back through Telegram. This is expected for the stated purpose, but it is an external message-sending action.

Skill content
use the `message` tool with `asVoice: true` and `media: <path.ogg>`
Recommendation

Use this skill only where Telegram auto-replies are intended, and review generated replies or switch to text mode if voice replies are not desired.

What this means

In a busy Telegram inbox, the fallback could transcribe the wrong recently saved voice note.

Why it was flagged

If no explicit attachment path is passed, the helper selects the newest inbound OGG file without binding it to the current Telegram sender or message.

Skill content
OGG_PATH="$(ls -t "${HOME}/.openclaw/media/inbound"/*.ogg 2>/dev/null | head -n 1 || true)"
Recommendation

Prefer passing the explicit attachment path from the message context; consider changing the helper to require a path or validate the sender/message before transcription.

What this means

The workspace may retain Telegram sender IDs and their voice/text preference until the state file is deleted.

Why it was flagged

The skill stores persistent per-user reply-mode state using Telegram sender IDs. This is disclosed and purpose-aligned, but it is persistent local state.

Skill content
State file: `voice_state/telegram.json`; Key: Telegram sender user id
Recommendation

Keep the workspace private and delete `voice_state/telegram.json` if you want to reset or remove stored reply preferences.

What this means

A compromised or untrusted local `yap` or `ffmpeg` binary would affect the safety of this workflow.

Why it was flagged

The skill relies on locally installed third-party binaries rather than installing them itself. No hidden installer is shown, but binary provenance matters.

Skill content
`yap` CLI available in `PATH` ... Project: https://github.com/finnvoor/yap ... `ffmpeg` available in `PATH`
Recommendation

Install required binaries from trusted sources and keep them updated.