Voicenotes
v1.0.0Sync and access voice notes from Voicenotes.com. Use when the user wants to retrieve their voice recordings, transcripts, and AI summaries from Voicenotes. Supports fetching notes, syncing to markdown, and searching transcripts.
⭐ 1· 2k·1 current·1 all-time
byShawn Hansen@shawnhansen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description (sync voice notes from voicenotes.com) matches the actual code: scripts call api.voicenotes.com to list recordings, fetch user info, and write markdown files. The operations requested (token-based API access, downloading notes, writing markdown) are coherent with the described purpose.
Instruction Scope
SKILL.md and the scripts instruct the agent to call the Voicenotes API, convert JSON to markdown, and write files to an output directory. The scripts only access the VOICENOTES_TOKEN env var, the API endpoint, and the workspace filesystem — all expected for a sync tool. They do not contact unexpected external endpoints or read unrelated system files.
Install Mechanism
There is no install spec (instruction-only plus shipped scripts). The scripts are plain shell with curl/jq usage. No downloads from arbitrary URLs or archive extraction are present.
Credentials
The skill requires a VOICENOTES_TOKEN and the sync script requires jq, but the registry metadata lists no required env vars or binaries. That mismatch means the manifest is incomplete and could mislead users or automated installers about required credentials and tooling. The single token is otherwise proportional for the described API access.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skill or system configs. It writes markdown files into the workspace (expected for a sync tool) and does not claim elevated or permanent privileges.
What to consider before installing
This skill appears to do what it says: call voicenotes.com API and write notes as markdown. However, the package metadata omitted required items — the scripts expect you to set VOICENOTES_TOKEN and the sync script requires jq. Before installing: (1) confirm the token is obtained from the legitimate Voicenotes settings URL and only grant the minimum-scoped token possible; (2) ensure jq is installed in the environment; (3) be aware the scripts will write files into the chosen output directory (ensure you trust that location); (4) because the skill source is 'unknown', prefer getting code from the official upstream or verifying the repository/maintainer; and (5) if you rely on automated policy checks, update the skill metadata to declare VOICENOTES_TOKEN and required binaries so installers and reviewers are not misled. These inconsistencies look like sloppy packaging rather than explicit malice, but verify the token's permissions and the upstream source before use.Like a lobster shell, security has layers — review code before you run it.
latestvk976dbpbbkfm50czr733azm6eh7zxsbv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.