TinkerClaw Jarvis Voice

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:50 AM UTC
• Version: 3.2.1

Overview

This skill is a disclosed local text-to-speech/persona add-on, with some install and persistence risks users should understand before enabling optional templates.

Install only if you want local audio playback and the Jarvis-style persona. Review bin/jarvis before putting it on PATH, prefer per-session template use over workspace-wide copies, avoid enabling SESSION.md if you do not want recent workspace activity referenced, and treat the unpinned model download as a supply-chain risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Note

• Location: templates/SESSION.md:14

Finding

Persistent Session Template Expands Access to Historical Activity

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: bin/jarvis:20

Finding

Temporary Directories Leak When Mute or Channel Gates Exit Early

Content

View full analysis

&2; exit 2; } for bin in ffmpeg aplay; do command -v "$bin" >/dev/null 2>&1 || { echo "jarvis: missing '$bin'" >&2; exit 3; } done [ -x "$TTS_DIR/bin/sherpa-onnx-offline-tts" ] || { echo "jarvis: sherpa-onnx not found at $TTS_DIR (set SHERPA_ONNX_TTS_DIR)" >&2; exit 3; } cleanup(){ rm ...[truncated 1602 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Downloaded TTS Model Archive Has No Integrity Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

Uninstall — removes every persistent change, immediately:

bash

rm -f ~/.openclaw/workspace/{VOICE,SESSION,HUMOR}.md

Precedence, so there are no surprises. Your instructions beat these files, every time. Ask

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

# --- OFF SWITCH (checked first, before anything runs) -----------------------
# Silence the voice permanently:  touch ~/.openclaw/jarvis-voice.mute
# Silence it for one command:     JARVIS_MUTE=1 jarvis "..."
# Re-enable:                      rm ~/.openclaw/jarvis-voice.mute
MUTE_FILE="${JARVIS_MUTE_FILE:-$HOME/.openclaw/jarvis-voice.mute}"
if [ -n "${JARVIS_MUTE:-}" ] || [ -f "$MUTE_FILE" ]; then
  exit 0

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · bin/jarvis (reported line 30)May include surrounding context.

text

# --- OFF SWITCH (checked first, before anything runs) -----------------------
# Silence the voice permanently:  touch ~/.openclaw/jarvis-voice.mute
# Silence it for one command:     JARVIS_MUTE=1 jarvis "..."
# Re-enable:                      rm ~/.openclaw/jarvis-voice.mute
MUTE_FILE="${JARVIS_MUTE_FILE:-$HOME/.openclaw/jarvis-voice.mute}"
if [ -n "${JARVIS_MUTE:-}" ] || [ -f "$MUTE_FILE" ]; then
  exit 0

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · templates/VOICE.md (reported line 1)May include surrounding context.

md

# VOICE.md — Jarvis voice output rules

> **Optional file.** Copying this into your workspace root changes agent behaviour in every
> future session. Delete it to stop, immediately and completely. Your explicit instructions

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · templates/VOICE.md (reported line 43)May include surrounding context.

md

overheard and the transcript is visible to anyone reading the chat later. Summarise instead:
  "the credentials are in the reply below."
- **Metadata.** Channel gating uses only the channel name the runtime provides. Do not read,
  parse or log session identifiers for this purpose.
</consent_and_silence>

<rules>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to invoke a local shell command (jarvis) and includes install-time shell-related capabilities, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent/runtime may permit shell execution more broadly than intended, increasing the risk of unintended command use or future drift if the package changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

**Purple is in the reply. Audio is extra.**

1. First line of a Tinker-home answer: `**Jarvis:** *spoken text*` (italics required — the UI
   only paints `.jarvis-voice` on italic). You write this yourself, in the reply text.
2. Optionally also run `jarvis "the same spoken text"` in the background so the speaker fires.

**The script does not touch the chat.** It generates audio and plays it — nothing else. Older

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown explicitly states 'Language: English ONLY' and instructs the agent to avoid non-English speech unless the user chooses an English summary or installs another voice. This is a language/locale constraint presented as a hard limitation of the skill, but the file does not frame it as a user opt-in choice at activation time or as a justified regional compliance requirement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

- **Language:** English ONLY. The Alan model cannot handle other languages.

<rules>
1. First line of the Tinker-home answer is `**Jarvis:** *text*` — italics required for purple. Write it in the reply; do not wait for inject.
2. Also call `jarvis` with `background: true` for audio. Blocking on playback delays the visual response.
3. Keep spoken text ≤ 1500 characters; sherpa-onnx truncates above that.
4. One `jarvis` audio call per response — stacked calls fight over the audio device.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

3. Keep spoken text ≤ 1500 characters; sherpa-onnx truncates above that.
4. One `jarvis` audio call per response — stacked calls fight over the audio device.
5. The bundled Alan voice is **English only**. Do NOT silently translate or condense someone's
   content into English just to make it speakable — that changes their meaning without asking.
   If the reply is not in English, say so and offer the choice: keep it text-only, speak an
   English summary if they want one, or install a voice for their language. Text-only is the
   default when in doubt.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · bin/jarvis (reported line 23)May include surrounding context.

text

# names here ($$ is guessable): another process running as the same user could pre-create or
# symlink the path and have us overwrite a file of their choosing.
WORKDIR="$(mktemp -d "${TMPDIR:-/tmp}/jarvis.XXXXXXXXXX")" || exit 6
chmod 700 "$WORKDIR"
RAW="$WORKDIR/raw.wav"
FINAL="$WORKDIR/final.wav"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file contains conflicting instructions: earlier text says sensitive, urgent, or distressing situations should suppress the persona, but the role block explicitly praises bone-dry humor during crisis. In safety-critical moments, that contradiction can cause the agent to retain joking behavior when users need clear, empathetic, low-risk communication, increasing the chance of harmful tone, degraded trust, or unsafe handling of urgent requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill strongly imposes a JARVIS-style persona and says wit is the personality, which can pressure downstream behavior even though the header notes the file is optional and user tone should win. Without explicit opt-in at time of use, the assistant may adopt a stylized tone that is unwanted, culturally mismatched, or inappropriate in shared/professional contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The file is designed to persistently alter agent behavior across future sessions when copied into the workspace root, and it instructs the agent to trigger a background local command on each reply. Even though this is framed as a UX feature, persistent behavioral modification plus automatic side-effecting command execution creates a risky trust boundary: users may forget it remains active, and future conversations could unexpectedly cause audio output or local process execution.

Content

Scanner excerpt · templates/VOICE.md (reported line 25)May include surrounding context.

md

Then also run `jarvis "<the same spoken text>"` in the background so the speaker fires. If only
one of the two can happen, the written line wins — it is what the user actually reads.

**The script does not write anything to the chat.** It renders audio and plays it. You author
the visible line yourself; nothing else does. (Older versions had the script post the line too,
which produced two copies of every answer. That code path is gone.)
</how_to_speak>

Static analysis

No suspicious patterns detected.