agentskill.sh
secured
clawdtalk-client
ClawdTalk — Voice calls, SMS, and AI Missions for Clawdbot
Security score
This tab presents tested categories, issue summaries, and source snippets in an audit-style report.
High / Medium / Low
Categories Tested
Instruction boundariesFilesystem writesNetwork referencesPlatform-specific install flow
Security Issues
High
Command Injection
Line 30
Template literal with variable interpolation in command context
- API key is stored in `skill-config.json` — use env var `CLAWDTALK_API_KEY` or a `${CLAWDTALK_API_KEY}` reference to avoid plaintext storage.
Medium
File Access
Line 5
Access to hidden dotfiles in home directory
metadata: {"clawdbot":{"emoji":"📞","primaryEnv":"CLAWDTALK_API_KEY","homepage":"https://github.com/team-telnyx/clawdtalk-client","requires":{"env":["CLAWDTALK_API_KEY"],"bins":["bash","node","jq","py
Medium
File Access
Line 162
Access to hidden dotfiles in home directory
> `setup.sh` reads your gateway config to extract connection details and (with confirmation) adds `sessions_send` to `gateway.tools.allow`. Gateway config is at `~/.openclaw/openclaw.json` or `~/.claw
Low
External Calls
Line 20
External URL reference
| `https://clawdtalk.com` (WebSocket) | `ws-client.js` | Voice transcripts, tool results, conversation state |
Low
External Calls
Line 21
External URL reference
| `https://clawdtalk.com/v1/*` | `telnyx_api.py` | Mission state, events, scheduled calls/SMS, assistant configs |
Low
External Calls
Line 22
External URL reference
| `http://127.0.0.1:<port>` | `ws-client.js` | Transcribed speech (local gateway only) |
Low
External Calls
Line 158
External URL reference
1. **Sign up** at [clawdtalk.com](https://clawdtalk.com)
Low
External Calls
Line 204
External URL reference
**Required**: Python 3.7+, `CLAWDTALK_API_KEY` environment variable. Optionally set `CLAWDTALK_API_URL` to override the default endpoint (defaults to `https://clawdtalk.com/v1`).
Low
External Calls
Line 807
External URL reference
| `server` | Server URL (default: `https://clawdtalk.com`) |
Low
External Calls
Line 814
External URL reference
- `CLAWDTALK_API_URL` — override the API endpoint (default: `https://clawdtalk.com/v1`)Mitigations
Review the upstream repository before copying files into a local skills directory.
Confirm install instructions and supported runtimes against SKILL.md instead of a generic readme.