The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/transcribe.sh accesses the sensitive configuration file ~/.openclaw/workspace/.env to extract API credentials. While this is used for the skill's functional purpose, direct access to environment files bypasses standard environment management and exposes sensitive paths.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its transcription workflow.
Ingestion points: Untrusted audio files are processed by scripts/transcribe.sh and converted to text.
Boundary markers: The transcript is saved in scripts/save_voice_note.py by appending raw text to markdown files without delimiters or instructions to ignore embedded commands.
Capability inventory: The agent can perform network requests (curl) and write to the local file system (~/.openclaw/workspace/memory/).
Sanitization: There is no validation or filtering of the transcription output before it is integrated into the agent's workspace and memory.
[PROMPT_INJECTION]: Misleading metadata in SKILL.md claims the service is powered by Deepgram Nova-3, while the implementation actually utilizes OpenAI and OpenRouter, which could lead to data being sent to unintended third-party providers.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to api.openai.com and openrouter.ai. These are well-known services, but the operations involve sending user-provided audio data and retrieved API keys.
[COMMAND_EXECUTION]: The skill relies on shell (scripts/transcribe.sh) and Python (scripts/save_voice_note.py) scripts to handle file operations and network communication.

voice-transcriber