Voxrn

Place phone calls, send SMS, search contacts, and run agent dispatches via Voxrn. Bridges any OpenClaw-bridged chat (Slack, Telegram, iMessage, WhatsApp, Dis...

Security Scan

The skill's behavior matches a Voxrn telephony integration, but the package metadata omits required secrets/credential declarations (VOXRN_API_KEY/BASE_URL) and the source/owner is unknown — this mismatch and lack of provenance merit caution.

Purpose & Capability

The skill's name/description, required binary (openclaw), SKILL.md, README, and mcp.json consistently describe a Voxrn telephony integration — calling, SMS, contacts, balance — which is coherent. However, the registry metadata claims 'Required env vars: none' and 'Primary credential: none', while SKILL.md and mcp.json clearly require VOXRN_API_KEY (and optionally VOXRN_BASE_URL). This metadata omission is an inconsistency that should have been declared.

Instruction Scope

SKILL.md instructions stay within the stated purpose: they describe searching contacts, quoting cost, placing/ending calls, streaming transcripts, and sending SMS. They explicitly instruct not to echo the API key and to use OpenClaw secrets so the secret isn't shown to the agent. Note: the skill necessarily transmits phone numbers, message text, call audio/captions, and user-provided task briefs to the Voxrn MCP endpoint — this is expected but has privacy implications.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so there is no archive download or arbitrary code install risk. The only required binary is 'openclaw', which is appropriate for an OpenClaw skill.

Credentials

Functionally the skill needs a bearer API key (VOXRN_API_KEY) and optionally VOXRN_BASE_URL; mcp.json uses the Authorization Bearer header. Those are proportionate to the telephony purpose, but the registry metadata failing to declare them is a problem: required credentials were not advertised, making it harder to assess privileges before install. Also consider that providing the API key grants the skill the ability to place calls and send SMS (potential billing and privacy exposure); ensure the key's scope and billing controls are appropriate.

Persistence & Privilege

The skill does not request 'always: true' and does not appear to require unusual persistent privileges. Installing it will register an outbound MCP server in the OpenClaw workspace (update to OpenClaw config), which is expected for this integration. That workspace-level registration should be reviewed because it enables outbound network actions under the provided API key.

What to consider before installing

This skill appears to be a legitimate Voxrn integration, but the package metadata omitted the fact that it needs a Voxrn API key (VOXRN_API_KEY) and optional VOXRN_BASE_URL — verify this before installing. Actionable steps: - Confirm the skill's provenance (owner ID and source are unknown here). Prefer installing only from a verified publisher or the official Voxrn/OpenClaw repos. - If you proceed, create a least-privileged Voxrn API key scoped for the actions you want and store it in OpenClaw's secrets manager (openclaw config secrets set ...) rather than a plain env var. - Recognize privacy/billing effects: installing and registering the MCP server will allow outbound calls/SMS and streaming transcripts to voxrn.com; phone numbers, message bodies, and audio will flow to that service. - Ask the publisher to correct registry metadata to declare VOXRN_API_KEY as a required credential and to provide trustworthy homepage/source links. If the publisher cannot verify identity or you cannot limit billing/permissions on the API key, do not install.

Voxrn is a browser-native voice + SMS platform with an MCP-driven agent runtime. This skill registers Voxrn as an outbound MCP server in your OpenClaw workspace, so the agent can place calls, send messages, manage contacts, and watch live agent sessions from any bridged chat.

When to use this skill

Reach for these tools when the user asks to:

• place a phone call — "call my plumber", "ring the front desk", "dial [phone]"
• send a text message — "text Mina that I'm running 5 min late"
• find a contact — "what's the number for Atlas Freight?"
• save someone to contacts — "save [phone] as Front Desk"
• see what's on the wire — "are any agent calls running?"
• end a runaway agent call — "kill the call to Mina"
• check the balance — "what's my Voxrn balance"

Tool catalog

Tool	Args	Use it for
call.place	{ to: E.164, taskBrief?: string, voiceProfileId?: string }	Dial out — agent runs the call following the task brief
call.list_active	none	Show currently-live calls in the workspace
call.end	{ callSid: string }	Hard-kill an active call by SID
transcript.stream	{ callSid: string }	Subscribe to live captions for a call
message.send	{ to: E.164, body: string }	Send an SMS
contact.search	{ q: string }	Free-text search across name, number, tag
contact.upsert	{ name, number, tags?, notes? }	Create or update a contact
balance.check	none	Read the workspace balance in USD

Configuration

Set these env vars (or use OpenClaw's secrets manager):

export VOXRN_API_KEY="vxk_..."   # mint at https://voxrn.com/enterprise/dashboard/agents
export VOXRN_BASE_URL="https://voxrn.com"  # optional; defaults to prod

Or:

openclaw config secrets set voxrn_api_key vxk_...

The skill's mcp.json reads ${VOXRN_API_KEY} at MCP-registration time so the secret never reaches the agent's prompt window.

Conventions the agent should follow

• Confirm the destination first. If the user says "call Atlas", run contact.search { q: "Atlas" } and ask which match before placing the call.
• Quote the cost before running call.place. Default rate-card multiplier is 1.25× over carrier; international calls can be more. Either ask "ok if this costs ~$X for a 2-minute call?" or run balance.check first.
• Pass the user's prose into taskBrief. Don't reformat — the brief travels straight to the agent runtime.
• Confirm before call.end unless the user explicitly said "kill it now". Action is destructive and audit-logged.
• Never echo the API key. The skill registers the server with ${VOXRN_API_KEY} so the agent never sees the secret.

Examples

Place a call

User: call my plumber and ask if Thursday morning works for the kitchen sink

agent: contact.search { q: "plumber" }
→ [{ id: "c-12", name: "Atlas Plumbing", number: "[phone]", tags: ["plumber"] }]

agent: balance.check {}
→ { usd: 23.40 }

agent: "Calling Atlas Plumbing at [phone] to ask about Thursday morning availability. Estimated cost: ~$0.04. Going ahead."

agent: call.place {
  to: "[phone]",
  taskBrief: "Call Atlas Plumbing on the user's behalf. Ask if Thursday morning is available to fix a kitchen sink leak. If yes, confirm a 9am window. If no, ask what's their next opening this week."
}
→ { callSid: "CAabc...", reservedUsd: 0.04 }

agent: "Call placed. SID CAabc... — I'll let you know when it ends."

End a call

User: kill the call to Mina, the agent's stuck

agent: call.list_active {}
→ [{ callSid: "CAxyz...", to: "[phone]", durationSeconds: 142, billedUsd: 0.05 }]

agent: "I see one active call to [phone] — duration 2:22, $0.05 spent. End it?"
user: yes
agent: call.end { callSid: "CAxyz..." } → { ok: true }

Send an SMS follow-up

User: text Mina that the meeting moved to 2pm tomorrow

agent: contact.search { q: "Mina" }
→ [{ id: "c-1", name: "Mina Hart", number: "[phone]" }]

agent: message.send { to: "[phone]", body: "Hey Mina — meeting moved to 2pm tomorrow. — Sent via Voxrn" }
→ { messageSid: "SMabc...", segments: 1, billedUsd: 0.0079 }

agent: "Sent."

Troubleshooting

• 401 Unauthorized from a Voxrn tool — your API key is wrong, expired, or the workspace it belongs to has been removed. Mint a fresh key at https://voxrn.com/enterprise/dashboard/agents → API keys.
• Calls succeed but the agent says nothing — destination might have hit voicemail or returned caller_audio_failed. Check call.list_active for state. The Voxrn live monitor mirrors this view at https://voxrn.com/enterprise/dashboard/agents.
• balance.check returns 0 — top up the workspace via Stripe or USDC at https://voxrn.com/account → Billing.

See also

• Voxrn docs — MCP overview
• Voxrn docs — OpenClaw integration
• Voxrn API reference
• OpenClaw — outbound MCP servers