ClawHub

Voicenotes Official

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Voicenotes integration that can search/read transcripts and create notes in your account, with no hidden code or unrelated data flows found.

Install only if you are comfortable letting OpenClaw use your Voicenotes API key to search notes, retrieve full transcripts, and create notes in your account. Prefer a revocable or dedicated key if available, avoid storing secrets in notes, and ask the agent to confirm before broad transcript retrieval or note creation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill explicitly enables retrieval of full transcripts and creation of notes containing potentially sensitive personal data, but it does not prominently require user confirmation, warn about privacy implications, or advise minimizing disclosure. In an agent setting, this can lead to over-collection, unintended exposure of private note content to the model context, or writes to a persistent external service without sufficiently explicit user awareness.

External Transmission

Medium
Category
Data Exfiltration
Content
- `query` (required): The search query string

```bash
curl -X GET "https://api.voicenotes.com/api/integrations/open-claw/search/semantic?query={search_query}" \
  -H "Authorization: $VOICENOTES_API_KEY"
```
Confidence
90% confidence
Finding
https://api.voicenotes.com/

External Transmission

Medium
Category
Data Exfiltration
Content
**If you want more context get the whole transcript:**

```bash
curl "https://api.voicenotes.com/api/integrations/open-claw/recordings/{recording_uuid}" \
  -H "Authorization: $VOICENOTES_API_KEY" \
```
Confidence
87% confidence
Finding
https://api.voicenotes.com/

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: voicenotes
description: This official skill from the Voicenotes team gives OpenClaw access to new APIs and the ability to search semantically, retrieve full transcripts, filter by tags or date range and create text notes — all through natural conversation.

homepage: https://voicenotes.com
metadata:
Confidence
86% confidence
Finding
create text notes — all through natural conversation. homepage: https://voicenotes.com metadata: openclaw: emoji: "📝" requires: env: - VOICENOTES_API_KEY bins: -

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal