ClawVoice

• Verdict: Pass
• Analyzed: May 10, 2026, 6:28 AM
• Findings: 0
• Version: 1.1.3
• Hash: c0dcfda0738ef4007591922d40d606137c86f761255c9ca64313a494e7e3006c
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: clawvoice Version: 1.1.3 The ClawVoice skill bundle is a legitimate telephony integration for OpenClaw that facilitates voice calls and SMS via Twilio and Telnyx. The codebase demonstrates significant security awareness, including automated tool restrictions for voice sessions (blocking high-risk tools like 'exec' and 'browser' in dist/hooks.js), prompt injection detection for agent responses, and PII protection through phone number masking in notifications (dist/services/post-call.js). It also implements robust webhook signature verification and rate limiting (dist/routes.js). While the plugin uses internal module probing for host compatibility (dist/index.js), it includes explicit trust boundary checks to prevent path traversal.