ClawHub
Back to skill

Security audit

hotbutter voice chat

Security checks across malware telemetry and agentic risk

Overview

This voice bridge is mostly transparent, but users should review it because it sends voice transcripts and agent replies through hotbutter.ai while one registry summary misleadingly describes the setup as self-hosted.

Install only if you are comfortable with spoken text and agent responses passing through hotbutter.ai, or configure `--relay-url` to a relay you control. Use it with an OpenClaw agent whose permissions are appropriate for voice input, and avoid sessions where secrets or private data may be spoken or printed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
lib/agent-bridge.js:29