voice-extract

• Outcome: Review
• Latest audit: Aug 26, 2026 · 1:35 PM UTC
• Version: 1.9.19

Overview

This skill has a coherent voice-profile purpose, but it persistently stores sensitive writing samples and generated voice instructions with weak consent, retention, and anonymization controls.

Review this skill before installing. It appears local and purpose-aligned, with no exfiltration or destructive behavior found, but only use it with writing samples you are comfortable storing under ~/.claude/voice-profiles. Check and delete saved samples or profiles after use, and be cautious with the detector-related wording and any project .voice/override.md files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the system to produce 'detection-neutral' writing and claims the techniques avoid increasing AI detectability. That goes beyond benign voice extraction and can facilitate evasion of AI-origin or policy enforcement systems by helping generated text appear less detectable. In context, the phrase is not incidental; it is embedded as part of the output profile, which makes the risky behavior operationalized and repeatable.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module claims to anonymize samples, but the implementation only copies files verbatim into a persistent profile directory. This creates a mismatch between documented privacy protections and actual behavior, which can cause sensitive identifiers, metadata in content, and source context to be retained and later processed or exposed.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger list includes broad everyday terms like 'voice,' 'writing,' and 'extraction,' which can cause accidental invocation in unrelated contexts. While not directly a code-execution flaw, overbroad triggers increase the chance that the skill activates on unintended user input and starts collecting, analyzing, or storing sensitive writing samples without clear user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill stores user-derived writing samples and generated profiles under ~/.claude/voice-profiles without an explicit upfront warning in the skill description. Because writing samples may contain personal, proprietary, or sensitive information, silent persistence creates a privacy and data-retention risk, especially if users do not realize their content is being saved locally.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The module explicitly directs the agent to create and later merge files under both the user's home directory and a project directory, but it does not require user confirmation, disclose that local files will be written, or define any safety boundaries around those writes. In an agent setting, silent persistence to disk can surprise users, overwrite existing configuration, or create long-lived prompt-influencing artifacts that affect future behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The directory mode instructs the agent to copy user writing samples into a long-lived directory under the user's home folder without an explicit notice that potentially sensitive personal content will be retained. In a voice-extraction skill, writing samples are especially likely to contain personal, professional, or proprietary material, so silent persistence increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Interactive mode asks users to paste writing samples but does not disclose that the pasted content will be written to files for later processing. Users may assume ephemeral analysis, and the undisclosed storage of free-form text can capture sensitive personal information, credentials, confidential work content, or copyrighted material.

Ssd 2

Medium

• Confidence: 98% confidence
• Finding: The instructions semantically promote evasion by framing style imitation as not increasing AI detectability. Even without explicit jailbreak wording, the practical effect is guidance for making generated text harder to identify as AI-assisted, which can undermine detection, moderation, provenance, or academic integrity controls. The context makes this more dangerous because it is packaged as a reusable craft rule inside a profile artifact.

Session Persistence

Medium

• Category: Rogue Agent

Content

descriptions, especially for registers where subtle tonal
   shifts matter.

## Required TodoWrite Items

1. `voice-extract:samples-collected` - Writing samples gathered
2. `voice-extract:samples-anonymized` - Labels stripped, numbered

• Confidence: 73% confidence
• Finding: The skill defines TodoWrite/session-persistence artifacts for tracking progress across a multi-step extraction workflow. On its own this is not highly dangerous, but in context it contributes to retention of sensitive user-writing analysis state and may preserve evidence of collected samples, profiles, and processing steps longer than necessary. This increases privacy exposure when combined with local file storage.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Register Creation Module

Create voice registers from extraction output.

## Default Register

• Confidence: 84% confidence
• Finding: The instruction to create voice registers from extraction output establishes persistent state that survives the current session, specifically by storing derived profile data in local files for reuse by later skill activations. Persistent agent-generated state is risky because it can embed unreviewed instructions or sensitive stylistic data that later influences outputs across sessions and projects.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.