zzz

This skill appears to do what it claims (make automated AI phone calls) and requires the Vapi API key, assistant and phone-number IDs, plus a public webhook URL. Before installing: - Treat the host running this skill as an internet-facing service: prefer an isolated VM/container, not your personal laptop or a machine with sensitive data. - Use a dedicated Vapi API key with the minimum required permissions and be prepared to rotate it if needed. - Limit the exposure of the webhook (use Cloudflare Tunnel or a reverse proxy with access controls) and avoid long-lived public ngrok URLs tied to your primary account. - Confirm the package source/repository (SKILL.md references a GitHub repo) and verify the publisher; the registry metadata has minor inconsistencies (skill name/owner vs. files). - Review logs written to ~/.openclaw/workspace/logs and ensure they don't contain PII you want to avoid storing locally; consider redirecting logs to a controlled location. - Ensure you comply with laws and platform policies for automated calls and consent in your jurisdiction. If you need higher assurance, request the publisher to declare the primary credential and confirm the canonical repository or run the code in a sandboxed environment and audit network traffic.