voice-learn

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.9.19

Overview

This voice-learning skill is mostly purpose-aligned, but it needs review because it can persist edited content and profile changes, and its snapshot path handling is under-scoped.

Review before installing. Use it only for voice-profile workflows where you are comfortable storing generated, reviewed, and manually edited drafts under your local profile directory. Avoid sensitive drafts unless snapshot retention is acceptable, and ensure piece names are constrained to safe filename characters before any snapshot commands run.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: modules/snapshot-management.md:39

Finding

Unsanitized Snapshot Name Allows Path Traversal and Arbitrary Local File Overwrite

Content

View full analysis

Vulnerability Details

File Location: modules/snapshot-management.md, lines 39–42, 47, and 53
Vulnerability Type: Path traversal through an unsanitized filename component
Risk Level: Medium

Vulnerable Code

bash

SNAP_DIR="$HOME/.claude/voice-profiles/$PROFILE/learning/snapshots"
PIECE_NAME="$1"
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
cp "$OUTPUT_FILE" "$SNAP_DIR/${PIECE_NAME}-${TIMESTAMP}-pre-review.md"

The same unsafe destination-path construction is used for the other snapshot stages:

bash

cp "$REVIEWED_FILE" "$SNAP_DIR/${PIECE_NAME}-${TIMESTAMP}-post-review.md"

bash

cp "$EDITED_FILE" "$SNAP_DIR/${PIECE_NAME}-${TIMESTAMP}-post-edit.md"

Technical Analysis

PIECE_NAME is populated from the first positional argument and inserted directly into the snapshot destination path without validation or normalization.

Shell quoting prevents shell metacharacters in PIECE_NAME from being interpreted as commands, so this is not command injection. However, quoting does not neutralize path separators or .. traversal components. An attacker who can control the piece name can therefore cause the resolved destination to escape the intended snapshot directory.

The timestamp and fixed suffix constrain the resulting filename, but they do not prevent traversal into another directory. If the resulting target path exists or can be created in a writable directory, cp can overwrite it under the privileges of the process running the skill. The issue affects pre-review, post-review, and post-edit snapshot capture.

Attack Path

1. The attacker supplies a piece name containing traversal components, such as ../../../../tmp/attacker-controlled.

2. The skill assigns that value to PIECE_NAME.

3. Snapshot capture constructs a destination resembling:

   text

   $SNAP_DIR/../../../../tmp/attacker-controlled-20260410-143022-pre-review.md
   

4. The operating system resolves the .. components, placing the destination outside `$SN ...[truncated 1074 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate PIECE_NAME using a strict allowlist before constructing any path. For example, permit only letters, digits, periods, underscores, and hyphens:

   bash

   case "$PIECE_NAME" in
     ""|*[!A-Za-z0-9._-]*)
       printf '%s\n' "Invalid piece name" >&2
       exit 1
       ;;
   esac
   

2. Explicitly reject absolute paths, path separators, . and .. as complete names, and all traversal components.

3. Canonicalize the snapshot directory and destination, then verify that the destination remains beneath the canonical snapshot directory before writing.

4. Ensure the snapshot directory exists with restrictive permissions:

   bash

   install -d -m 700 -- "$SNAP_DIR"
   

5. Use -- before path arguments so values beginning with a hyphen cannot be treated as options:

   bash

   cp -- "$OUTPUT_FILE" "$DESTINATION"
   

6. Consider no-clobber or atomic creation behavior to prevent accidental overwrites, and reject symbolic-link destinations where appropriate.

7. Apply the same validation and containment checks consistently to pre-review, post-review, and post-edit capture operations.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list uses very generic terms like "voice," "learning," "improvement," and "feedback," which are likely to collide with ordinary user requests and invoke this skill unexpectedly. In context, that is risky because the skill is designed to read snapshots, inspect prior profile data, update accumulator state, and apply changes to local profile files, so accidental activation could cause unintended data access or modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description says it improves a voice profile over time, but it does not clearly warn up front that it reads prior snapshots and updates local files such as the accumulator and profile rules. That omission increases the chance that a user or calling agent invokes it without understanding the privacy and integrity implications of scanning edited content and writing persistent changes to local profile data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module describes automatic and user-triggered copying of generated, reviewed, and manually edited text into a persistent directory under the user's home folder, plus later archival or deletion, but it does not require explicit user notice or consent. Because these snapshots can contain sensitive draft content, edits, or confidential material, silent retention and lifecycle management create a privacy and data-governance risk even if the behavior is not overtly malicious.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.