registry / @komaa/msteams-voice / 0.1.1

@komaa/msteams-voice@0.1.1

Renamed: install @komaa/openclaw-msteams-bridge instead.

Self-contained Microsoft Teams CVI realtime-voice plugin for OpenClaw. Builds on the public realtime-voice SDK + api.runtime — no voice-call fork, no vendored CallManager. Single openclaw plugins install.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On host startup, the declared OpenClaw plugin can run a Teams voice bridge and delegate authenticated call input to the configured host agent. This is a guarded, package-owned agent extension rather than install-time mutation or stealth persistence.

Static reason

No blocking static signals were detected.

Trigger

User installs/enables the OpenClaw plugin with a shared secret; host startup and an authenticated Teams call activate it.

Impact

Configured callers may invoke the enabled host-agent capabilities through Teams; defaults deny inbound callers and disable general agent tools.

Mechanism

Authenticated Teams WebSocket bridge with host-agent delegation

Rationale

Source inspection found no install-time execution, foreign configuration mutation, secret exfiltration, or remote payload loading. The declared startup extension and host-agent delegation warrant a warning under the extension-lifecycle policy.

Evidence

package.jsonopenclaw.plugin.jsondist/index.jsdist/msteams-media-stream.jsdist/msteams-runtime.jsdist/msteams-realtime.jsdist/allowlist.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with false-positive risk.

@komaa/msteams-voice@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Findings