Howto: Full Local Control of Alexa using Node-Red

[Glenn]

 I just found this tool that allows you to do everything on your Alexa locally and quite frankly it's amazing.

I'm not sure if there are any security risks so please pipe in if they are.

Basically you need to get the BST Proxy from http://www.bespoken.tools/

Follow the guide and create your Amazon dev account and do regular testing.

When you get to the point you are happy with how everything is working then we can do the fun stuff with Node-Red.

• Start from command-line bst proxy http 1880 or what ever port your Node-Red HTTP is set as
  Keep note of what is written bellow it
  

  Your URL for Alexa Skill configuration:
  https://proxy.bespoken.tools/YOUR/SKILL/PATH?node-id=xxx
  

  
  
• Go into the Alexa dev portal and use that address as the configuration endpoint.
  For example if you want to push stuff from /playback on Node-red you would enter: https://proxy.bespoken.tools/playback?node-id=xxx
  
  
• In Node-Red create a HTTP-In node with POST and name it with the skill name you want to test.
  Eg as above I did playback to I can test playback on my Sonos.
  
  
• Here is the part that is a bit tough. You need to define the response for Alexa if it's not valid it won't work. We can define this easily using a function node.
  Just use the information below and edit to suit
• SSML is what we want Alexa to repeat, we can also use an audio file that is less than 90 seconds but there are alot of restrictions so it's not worth it
• Type: We can have this as simple if we don't need an image. If we have it as simple change "text" to "content"
• Title is the card heading in the Alexa app
• text is the text that will show
• image is the image at the side of the text you can have both large and small images
  
• 
  msg.payload =
  {
    "version": "1.0",
    "response": {
      "outputSpeech": {
        "type": "SSML",
        "id": null,
        "ssml": "<speak> I want Alexa to reply saying this</speak>"
      },
      "card": {
        "type": "Standard",
        "title": "This is my card heading",
        "text": "This is my card text",
        "image": {
          "largeImageUrl": "This is my card image"
        }
      }
    },
    "sessionAttributes": null
  };
  
  return msg;
  
  
• 
  
• Then just have a HTTP response node and we are done

Use the Service Simulator to test.

As usual there will be lots of trial and error. Have fun and let me know how you go.

[Julian Knight]

A quick view on their website and I see no information at all on security. Does it connect over secure channels? Where is their proxy service located? Who has access to their servers? What logging do they do? What are their privacy policies?

Yup, plenty of risks. Whether they bother you is another matter of course.

[Glenn]

With every type of proxy there is the possibility of a man in the middle attack.

Everything is secured via HTTPS https://proxy.bespoken.tools

It uses a unique ID which is like a password.

You could further secure it by making sure the request applicationId matches the on Alexa.

Good points you make on their servers. You run a proxy on your local machine, so not sure if it stores the data or just pipes it through to your local proxy.

[Julian Knight]

Might be worth asking them. Sometimes the response is as telling as the answer ;-)

Being in the middle of a global ransomware attack, I'm even more paranoid than normal at present!

[Glenn]

There are other alexa skills for node-red that would be no different at least with this i didn't have to open ports

[Julian Knight]

Indeed, always something to bear in mind. Never get carried away by the "shiny".

Just note the new "feature" for Alexa, inserting spoken advertising. That won't be annoying at all will it!

[Glenn]

Yeh, but if I create all the skills myself it won't happen.

I wanted to make it so the request only came from LAN but it doesn't seem possible as it goes to Amazon and then down to Alexa.

Still interested to hear thoughts for people who might genuinely be interested in this as it can be quite good