Lunara Voice

Bundle for Lunara Voice OpenClaw plugin with install and publish helpers

Security Scan

The bundle and code match a Lunara Voice plugin (so it appears to be what it says) but it requests forced presence (always: true) and contains explicit runtime instructions that require autonomous, long-running network actions (outbound calls, silent polling, and LLM/data export) that increase risk and deserve human review before install.

Purpose & Capability

Name, description, plugin manifest, package.json and TypeScript source consistently implement a Lunara Voice OpenClaw plugin (agents, campaigns, calls, history, analytics, webhooks, exports). The files present are proportional to the stated purpose. Minor mismatch: registry lists no required env vars, but the plugin expects configuration (apiBaseUrl, apiKey, userEmail) placed in ~/.openclaw/openclaw.json — this is implementation-specific rather than malicious.

Instruction Scope

SKILL.md contains prescriptive runtime behavior that goes beyond simple tool documentation: it mandates that any user request to make a call must trigger an end-to-end workflow executed autonomously in a single turn, including recording timestamps, placing the call, then polling the history API every 25–30 seconds (up to 5 minutes) until the new call is found, retrieving transcripts, saving analytics/tags, and reporting results. The instructions also tell the agent to 'poll silently' and not message the user during polling. This grants the agent broad autonomous network activity (long-running polling, transcript reads, and data export) and could lead to unexpected data access or exfiltration if the plugin is given credentials.

Install Mechanism

No registry install spec; the bundle is instruction/source-based. Provided install script simply runs 'openclaw plugins install' against the bundled plugin directory — it does not download code from remote arbitrary URLs. This is lower risk than remote downloads, but installing the plugin will register many tools that can make network requests.

Credentials

The plugin expects API credentials (apiBaseUrl, apiKey, userEmail) which are reasonable for a remote voice/call API. However the plugin exposes features for bulk export and LLM training (lunara_export_bulk, mask_pii=false option), analytics saves, and full transcripts — these are sensitive operations. The manifest marks apiKey as sensitive; ensure you only provide credentials you trust and that the apiBaseUrl points to a trusted endpoint. The SKILL.md's guidance about disabling PII masking (mask_pii=false) is a potential privacy/data-exfiltration vector if misused.

Persistence & Privilege

The bundle metadata sets always: true, meaning the skill is force-included in every agent run. Combined with the plugin's ability to make outbound calls, fetch transcripts, perform exports, and the SKILL.md's requirement to autonomously perform long-running polling for calls, this markedly increases the plugin's blast radius. There is no clear, justified reason in the documentation why this plugin must be always-enabled for all agents.

What to consider before installing

This bundle appears to implement a real Lunara Voice plugin, but it has two properties you should weigh carefully before installing: (1) always: true — it will be force-loaded in every agent run, increasing exposure; and (2) the runtime instructions require autonomous, long-running network activity for every outbound call (silent polling, transcript reads, analytics, and data export). Only install if you fully trust the plugin source and the remote apiBaseUrl. If you proceed, do these things first: install in a restricted/test environment; inspect and, if possible, remove or disable the always flag; avoid supplying high-privilege or production credentials (use a limited API key); ensure PII masking remains enabled (do not set mask_pii=false); and review the plugin source (lunara-voice plugin/index.ts) for any endpoints or behaviors you do not recognize. If you are unsure about the provenance of this bundle (owner ID unknown, homepage metadata points to lunaravox.com), contact the vendor or prefer an official distribution channel.

Lunara Voice Bundle

This skill bundle ships everything needed to install and run the Lunara Voice plugin locally.

What is included

• plugin/ — full copy of the OpenClaw plugin source
• scripts/install-plugin.sh — local install helper
• references/PUBLISH.md — release and ClawHub publish steps

Install plugin from this bundle

Run:

bash {baseDir}/scripts/install-plugin.sh

Then restart Gateway.

Configure plugin

Set plugin config in ~/.openclaw/openclaw.json:

{
  "plugins": {
    "entries": {
      "lunara-voice": {
        "enabled": true,
        "config": {
          "apiBaseUrl": "https://your-server.herokuapp.com",
          "apiKey": "lnr_live_KEYID_SECRET",
          "userEmail": "[e-mail]"
        }
      }
    }
  }
}

Verify

openclaw plugins list
openclaw plugins info lunara-voice
openclaw plugins doctor