Telegram Multilingual Voice Reply

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Telegram voice-reply skill that uses local ASR/TTS scripts and Telegram messaging as described, with some normal but important dependency, messaging, and temporary-file considerations.

This skill appears safe for its stated Telegram voice-reply purpose. Before installing, make sure you are comfortable with it sending Telegram replies on your behalf, running local ASR/TTS helper commands, installing or using mlx_audio/ffmpeg/model dependencies, and leaving temporary audio or transcript files on your device.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can post replies in Telegram on your behalf when this workflow is used.

Why it was flagged

The skill sends Telegram messages using the user's OpenClaw/Telegram messaging capability. This is expected for a Telegram reply workflow, but it is delegated account action.

Skill content
用 OpenClaw `message` 工具发送(voice note + caption):- `asVoice: true` - `path/filePath`: 上一步生成的 `reply.ogg` - `caption`: **同一段 reply_text**
Recommendation

Install only if you want OpenClaw to send Telegram replies for you, and use the provided text-only or voice-only overrides when needed.

What this means

You may need to install and trust local ML tooling and model downloads before the skill works.

Why it was flagged

The workflow relies on external ML packages/models, while the registry lists no install spec or required binaries. This is purpose-aligned, but dependency provenance and installation need user review.

Skill content
STT 默认:`mlx-community/Qwen3-ASR-0.6B-8bit` ... `failed to import mlx_audio`:当前 `python3` 环境里没有安装到 `mlx_audio`。
Recommendation

Use a trusted Python environment, verify the mlx_audio package and model sources, and document/install ffmpeg and model dependencies explicitly.

What this means

The skill will run local Python/CLI tools to process audio when voice handling is requested.

Why it was flagged

The helper runs local CLI commands for ASR processing. This command execution is disclosed and central to the voice transcription purpose.

Skill content
cli = "mlx_audio.stt.generate" ... p = subprocess.run(cmd, capture_output=True, text=True)
Recommendation

Run it in a normal user environment, keep dependencies updated, and avoid installing untrusted replacement binaries named mlx_audio or ffmpeg.

What this means

Sensitive voice transcripts may remain temporarily or persistently on the local machine in temp folders.

Why it was flagged

In CLI fallback mode, transcription output is written to a local temporary directory before being read back, and the artifact does not show cleanup of that directory.

Skill content
out_prefix = Path(tempfile.mkdtemp(prefix="mlx_asr_out_")) / "out" ... txt_path = Path(str(out_prefix) + ".txt")
Recommendation

Use the skill on a trusted device and periodically clear temporary files if voice messages may contain sensitive information.