Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

claw-voice-local

v1.0.3

Convert text to offline Telegram voice messages using piper TTS. Use when the agent should speak a response, send audio, or deliver voice notes via Telegram...

0· 81·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for photon78/claw-voice-local.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "claw-voice-local" (photon78/claw-voice-local) from ClawHub.
Skill page: https://clawhub.ai/photon78/claw-voice-local
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install claw-voice-local

ClawHub CLI

Package manager switcher

npx clawhub@latest install claw-voice-local
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The scripts (say.py, speak.py, send_voice.py) implement exactly the advertised flow: local piper TTS + ffmpeg → OGG → send to Telegram Bot API. However the registry metadata lists no required environment variables or config paths, while SKILL.md and the code require TELEGRAM_BOT_TOKEN (required), optional TELEGRAM_CHAT_ID, and read a fallback ~/.openclaw/.env. The code also expects a piper binary (~/.local/bin/piper), voice model files (~/.local/share/piper/*.onnx), and ffmpeg — these are all consistent with the stated purpose but the missing declarations in the registry are an inconsistency.
Instruction Scope
Runtime instructions and code stay within scope: they run piper and ffmpeg locally, create temporary WAV/OGG files, and POST the resulting OGG to Telegram's API (api.telegram.org). The skill reads environment variables and a fallback config file (~/.openclaw/.env) for credentials — this is expected for a bot-integrated tool but worth noting since credential files are accessed. No other network endpoints or unexpected data-collection steps are present.
Install Mechanism
There is no automated install spec in the package. README instructs manual downloads from GitHub Releases (piper) and HuggingFace (voice models) and installation of ffmpeg via apt — these are known sources and align with the toolchain. No obscure or shortener URLs, and no opaque archive downloads from personal servers are present.
!
Credentials
The runtime requires a Telegram bot token (TELEGRAM_BOT_TOKEN) and optionally TELEGRAM_CHAT_ID; these are minimal and appropriate for the task. But the skill registry lists no required environment variables/config paths even though SKILL.md and code use them and read ~/.openclaw/.env as a fallback. That mismatch is material because users might not realize secrets are needed or where they are stored. The credential scope itself is proportional (only the Telegram bot token), but the missing metadata is a red flag.
Persistence & Privilege
The skill does not request 'always: true' or attempt to modify other skills or global agent settings. It runs on demand and uses local files in the user's home directory; it does not create long-lived background services or escalate privileges. It does read/write temporary files and may read ~/.openclaw/.env for credentials, which is normal for a user-space utility.
What to consider before installing
This skill's code appears to implement exactly what it claims: convert text to OGG with local piper + ffmpeg and send a Telegram voice note. However, the skill metadata omitted required credentials and config paths that the code and SKILL.md reference. Before installing or running: - Verify TELEGRAM_BOT_TOKEN is provided and store it securely (use a dedicated bot token and not a highly privileged account). - Ensure the fallback file ~/.openclaw/.env is intentionally used and has restrictive permissions (chmod 600) — review its contents before use. - Confirm you trust the recommended piper and model download sources (GitHub releases and HuggingFace). Download releases directly from the official project pages; verify checksums if available. - Consider creating a dedicated Telegram chat/bot for the skill and limit TELEGRAM_CHAT_ID to the intended recipient. - Because registry metadata omits required env vars, prefer running the scripts manually first (not as an unattended/service skill) and inspect behavior. If you plan to enable it for automatic agent use, add explicit exec allowlist entries and ensure your agent's environment only exposes the minimal required variables. Given the metadata/code mismatch, treat the package as 'suspicious' until the author corrects the declared requirements or you verify them yourself.

Like a lobster shell, security has layers — review code before you run it.

latestvk979rsj06m7awxmx7t9k5m3df585f3kqoffline piper telegram tts voice local raspberryvk979rsj06m7awxmx7t9k5m3df585f3kq
81downloads
0stars
4versions
Updated 3d ago
v1.0.3
MIT-0

claw-voice-local

Local offline TTS → Telegram Voice Note

Convert any text to a Telegram voice message using piper TTS — fully offline, no cloud API required. Runs on Linux (including Raspberry Pi / ARM64).

When to use

  • Send spoken responses instead of text messages
  • Read out summaries, alerts, or reports
  • Any task where audio feedback is more natural than text

Usage

python3 say.py "Your agent is ready."
python3 say.py "Good morning!" --chat-id 123456789
echo "Task complete." | python3 say.py

Configuration

Set these environment variables (or add to ~/.openclaw/.env):

VariableRequiredDescription
TELEGRAM_BOT_TOKENYesYour Telegram bot token
TELEGRAM_CHAT_IDOptionalDefault chat ID (can be passed as --chat-id)

Environment Variables

TELEGRAM_BOT_TOKEN=required   # Telegram bot token — get one from @BotFather
TELEGRAM_CHAT_ID=optional     # Default target chat ID

Config File

This skill reads ~/.openclaw/.env as a fallback for credentials. Ensure the file has restricted permissions: chmod 600 ~/.openclaw/.env

Installation

See README.md for step-by-step piper installation.

Files

FileDescription
say.pyMain entry point: text → Telegram voice note
speak.pyCore TTS: text → OGG Opus via piper + ffmpeg
send_voice.pyTelegram sender: OGG → voice message (no dependencies)

Requirements

  • Python 3.11+
  • piper binary (see README)
  • ffmpeg
  • A piper voice model (.onnx)
  • Telegram bot token

Comments

Loading comments...