ClawVoice

• Analyzed: May 12, 2026, 3:22 AM
• Findings: 1
• Version: 0.0.2
• Hash: a82ab3c0ba924ac06c050f0cbcda4de4d5cf95538a121f0dea8f18fe9b95446b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. The `client.py` script acts as a bridge between a WebSocket voice interface and the `openclaw agent` command. Crucially, it uses `shlex.quote()` to properly sanitize user input before passing it to the `openclaw agent` command, preventing shell injection. The `skill.md` documentation accurately describes this functionality and does not contain any prompt injection attempts or instructions for malicious behavior. There is no evidence of data exfiltration, persistence mechanisms, or other malicious activities.