discord voice memo upgrade

ReviewAudited by ClawScan on May 10, 2026.

Overview

The patch appears purpose-aligned, but it replaces core bot files and its default debug logging can expose message content and part of a TTS API key.

Treat this as a review-required core patch, not a normal skill. Before installing, inspect the replacement files, remove or mask the debug console.log statements, keep backups, and test outside production first.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

Installing this changes the bot's core runtime behavior, not just a small optional plugin.

Why it was flagged

The skill asks the user to copy replacement JavaScript files into the installed Clawdbot package and restart the bot.

Skill content

cp patch/dispatch-from-config.js $CLAWDBOT_DIR/lib/node_modules/clawdbot/dist/auto-reply/reply/
cp patch/tts.js $CLAWDBOT_DIR/lib/node_modules/clawdbot/dist/tts/

# 4. Restart clawdbot
clawdbot restart

Recommendation

Apply only after reviewing the patch or testing in a non-production bot, and keep the documented backups so you can revert.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less provenance to verify that these replacement files match an upstream fix.

Why it was flagged

The registry metadata does not provide a source repository or homepage for a package that replaces core bot files.

Skill content

Source: unknown
Homepage: none

Recommendation

Compare the patch against the official Clawdbot/Moltbot source or wait for an upstream release if provenance matters for your deployment.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Bot logs or log aggregation systems could reveal credential material and confirm which TTS account configuration is in use.

Why it was flagged

The debug logging prints whether an ElevenLabs key is present and includes the first 8 characters of the key.

Skill content

apiKey=${config.elevenlabs.apiKey ? "SET(" + config.elevenlabs.apiKey.slice(0, 8) + "...)" : "MISSING"}

Recommendation

Remove or mask this debug log before installing, especially in production or shared environments.

Medium

#ASI06: Memory and Context Poisoning

What this means

Private message text or voice memo transcripts may be written to console logs by default.

Why it was flagged

The patch logs the first 80 characters of the inbound message body during TTS debugging.

Skill content

console.log(`[TTS-DEBUG] inboundAudio=${inboundAudio} ... Body=${(ctx.Body ?? "").slice(0, 80)}`);

Recommendation

Make debug logging opt-in and avoid logging message bodies, or strip these console.log statements before use.

Info

#ASI07: Insecure Inter-Agent Communication

What this means

Text intended for speech synthesis may be processed by OpenAI, ElevenLabs, or Edge TTS depending on configuration.

Why it was flagged

The skill is designed to synthesize replies through external TTS providers, which may require sending reply text to those providers.

Skill content

"provider": "openai",  // or "elevenlabs" or "edge"

Recommendation

Use a provider and configuration that match your privacy requirements, and avoid sending sensitive conversations to external TTS services unless acceptable.