AnveVoice OpenClaw Skill enables voice AI integration for websites. This document outlines security considerations, data handling, and external dependencies.

View Full Scan Report on VirusTotal →

This skill communicates with the following endpoints:

When you deploy a voice bot, the following external script is embedded in your website:

<script src="https://anvevoice.com/embed.js" 
        data-bot-id="YOUR_BOT_ID"
        async>
</script>

What this script does:

• Loads the voice widget UI in the visitor's browser
• Captures microphone input (with user permission)
• Transmits voice data to AnveVoice servers for processing
• Displays AI responses and handles conversation flow

Data collected from visitors:

• Voice recordings (if enabled)
• Conversation transcripts
• Browser metadata (for analytics)
• Optional: Contact info (email, phone) if shared during conversation

• API Key Required: ANVEVOICE_API_KEY (starts with anvk_)
• Storage: Environment variable only — never hardcoded
• Scope: Configure minimal required permissions at anvevoice.com/developer

1. Use environment variables:

   export ANVEVOICE_API_KEY=anvk_your_key_here

2. Minimize API key scope:

   • Don't use "Full Access" unless necessary
   • Create separate keys for different environments (dev/staging/prod)

3. Rotate keys regularly:

   • Revoke old keys at anvevoice.com/developer
   • Generate new keys every 90 days

4. Monitor usage:

   • Check analytics for unexpected activity
   • Review conversation logs periodically

1. HTTPS required: Widget only works on HTTPS sites (for microphone security)

2. Privacy policy:

   • Disclose voice data collection in your privacy policy
   • Link to AnveVoice's privacy policy: https://anvevoice.com/privacy

3. User consent:

   • Widget requests microphone permission before recording
   • Users can decline and use text input instead (if configured)

4. Data retention:

   • Configure recording retention in AnveVoice dashboard
   • Default: 30 days (adjustable)

If you discover a security vulnerability:

1. Email: security@anvevoice.com
2. Subject: [SECURITY] Brief description
3. Do not publicly disclose until patched

We follow responsible disclosure and will acknowledge within 24 hours.

[![VirusTotal](https://img.shields.io/badge/VirusTotal-0%2F62%20Clean-brightgreen?style=flat-square&logo=virustotal)](https://www.virustotal.com/gui/file/f3c788a5cfa2a01b67edd6af451ee6748944818f20b7d51203ecf5cf8d4c837b?nocache=1)