Security audit
Security checks across malware telemetry and agentic risk
This is a functional avatar app, but it needs Review because it exposes a provider key to the browser and gives the local avatar server broad messaging and business-tool authority that is only partly disclosed.
Install only if you are comfortable giving this local server access to Simli, ElevenLabs, OpenClaw gateway credentials, and any enabled Slack/email integrations. Treat it as a Review-risk app: use restricted API keys, bind or firewall the server to trusted local access, avoid sensitive prompts unless vendor processing is acceptable, disable Slack/email/Stream Deck forwarding unless needed, and rotate the Simli key if this version has already exposed it to browsers.
const alertChannel = config.integrations.slack.alertChannel;
if (alertChannel) {
try {
const slackRes = await fetch('https://slack.com/api/chat.postMessage', {
method: 'POST',
headers: {
Authorization: `Bearer ${config.secrets.slackBotToken}`,if (action === 'alert_resolved' && config.secrets.slackBotToken) {
if (lastAlertTs && lastAlertChannel) {
try {
await fetch('https://slack.com/api/reactions.add', {
method: 'POST',
headers: {
Authorization: `Bearer ${config.secrets.slackBotToken}`,name: 'white_check_mark',
}),
});
await fetch('https://slack.com/api/chat.postMessage', {
method: 'POST',
headers: {
Authorization: `Bearer ${config.secrets.slackBotToken}`,? { text, model_id: 'eleven_turbo_v2_5', language_code: 'no' }
: { text, model_id: 'eleven_multilingual_v2' };
const ttsRes = await fetch(`https://api.elevenlabs.io/v1/text-to-speech/${voiceId}?output_format=pcm_16000`, {
method: 'POST',
headers: {
'xi-api-key': config.secrets.elevenLabsApiKey,"dependencies": {
"dotenv": "^16.4.0",
"express": "^5.2.1",
"simli-client": "latest",
"ws": "^8.19.0"
},
"optionalDependencies": {65/65 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal