Slybroadcast Voicemail

Send Slybroadcast ringless voicemail campaigns from OpenClaw/LLMs using CLI or MCP, including AI voice generation (ElevenLabs or generic HTTP voice API) and...

Security Scan

The skill's instructions match a Slybroadcast voicemail sender, but the package declares no install/files/required env while the runtime docs require many credentials and npm workspace tooling—these mismatches are suspicious and need clarification before use.

Purpose & Capability

The SKILL.md describes a Slybroadcast voicemail sender (including optional ElevenLabs TTS), which is coherent with the name. However the registry metadata lists no required env vars, binaries, or code files while the SKILL.md requires SLYBROADCAST_* credentials, ElevenLabs keys, and an npm workspace @fub/slybroadcast-voicemail. The declared manifest (no code, no install) does not align with what the instructions expect.

Instruction Scope

Instructions ask the agent/operator to run npm workspace commands, start an MCP server, stage local/AI-generated audio to a public URL, and rely on multiple environment variables. The skill's instructions reference filesystem staging and public URLs (possible data exfiltration vector) and expect an npm package that is not present in the bundle. The instructions also allow making audio files publicly reachable for Slybroadcast to fetch, which could leak sensitive recordings if misused.

Install Mechanism

There is no install spec and no code files, yet the SKILL.md instructs running npm workspace commands referencing @fub/slybroadcast-voicemail. That implies the skill expects external code to be present or installed, but provides no guidance where to obtain it. This gap is incoherent and increases risk (agent or user might be prompted to fetch/execute third-party code from unknown sources).

Credentials

The environment variables listed in SKILL.md (SLYBROADCAST_* plus ELEVENLABS_* and staging-related variables) are appropriate for the stated functionality, but none are declared in the skill metadata. The mismatch between declared and required env vars is a red flag. Requiring staging of audio to a public URL also broadens the data-sensitivity surface (public exposure of recordings).

Persistence & Privilege

The skill does not request always:true and is user-invocable; model invocation is allowed (normal). It does not claim to modify other skills or require elevated persistent system privileges in the manifest.

What to consider before installing

Do not provide credentials or deploy this skill yet. The runtime docs require Slybroadcast credentials, ElevenLabs keys, and an npm workspace package, but the skill package contains no code or install instructions and lists no required env vars—this inconsistency could lead you to run or fetch untrusted code or expose voicemail files publicly. Ask the publisher for: (1) the source repository or official homepage, (2) an install spec (where to get @fub/slybroadcast-voicemail), and (3) the actual code to review. If you must test, use throwaway/least-privilege Slybroadcast and ElevenLabs keys, keep audio staging on a controlled domain, and avoid uploading sensitive recordings. Prefer skills with verifiable source and explicit install instructions before trusting secrets.

Use this skill when the user wants to send one or many voicemail drops with Slybroadcast and optionally generate a voice recording from text.

Prerequisites

Required environment variables:

• SLYBROADCAST_UID (or SLYBROADCAST_EMAIL fallback)
• SLYBROADCAST_PASSWORD
• SLYBROADCAST_DEFAULT_CALLER_ID (or pass caller id explicitly)

For local-file or AI-generated audio, also set:

• SLYBROADCAST_PUBLIC_AUDIO_BASE_URL
• SLYBROADCAST_AUDIO_STAGING_DIR

For ElevenLabs voice generation:

• ELEVENLABS_API_KEY
• ELEVENLABS_TTS_VOICE_ID

CLI Commands

Run direct commands:

npm --workspace @fub/slybroadcast-voicemail run dev:cli -- send --help

Common examples:

1. Existing account recording title:

npm --workspace @fub/slybroadcast-voicemail run dev:cli -- send \
  --to "16173999981,16173999982" \
  --record-audio "My First Voice Message" \
  --caller-id "16173999980" \
  --campaign-name "Follow-up" \
  --schedule-at "now"

2. Public audio URL:

npm --workspace @fub/slybroadcast-voicemail run dev:cli -- send \
  --to "16173999981" \
  --audio-url "https://example.com/voicemail.mp3" \
  --audio-type mp3 \
  --caller-id "16173999980"

3. ElevenLabs text-to-voice + send:

npm --workspace @fub/slybroadcast-voicemail run dev:cli -- send \
  --to "16173999981" \
  --ai-text "Hi, this is your appointment reminder for tomorrow at 3 PM." \
  --ai-provider elevenlabs \
  --caller-id "16173999980"

4. Uploaded list on Slybroadcast platform:

npm --workspace @fub/slybroadcast-voicemail run dev:cli -- send \
  --list-id 94454 \
  --record-audio "My First Voice Message" \
  --caller-id "16173999980"

MCP Tools

Start the MCP server:

npm --workspace @fub/slybroadcast-voicemail run dev:mcp

Tool names:

• slybroadcast_voicemail_send
• slybroadcast_audio_list
• slybroadcast_phone_list
• slybroadcast_campaign_status
• slybroadcast_campaign_results
• slybroadcast_campaign_control
• slybroadcast_voice_generate

Notes

• Slybroadcast API delivery times are interpreted in Eastern Time and use 24-hour format (YYYY-MM-DD HH:MM:SS).
• Use one audio source per campaign request: account recording title, system audio file, public URL, local file, or AI text.
• Local and AI-generated files are staged first and must be publicly reachable for Slybroadcast to fetch.