TinkerClaw Jarvis Voice

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:32 AM UTC
• Version: 2.2.2

Overview

The skill is a disclosed voice/personality add-on, but it asks agents to run automatic background shell commands and install persistent workspace prompts with limited scoping or disable controls.

Install only if you want persistent JARVIS-style behavior across sessions and are comfortable with reply text being passed to a local shell command and the SkillBoss TTS service. Review the jarvis script and any workspace templates before use, avoid speaking sensitive content, and prefer adding an explicit mute or session-only toggle before enabling it broadly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is presented as a voice/personality enhancement, but it also instructs the agent to inject content into the chat UI via a gateway RPC. That expands its effective scope from local audio playback to message-generation/manipulation, which can misrepresent agent output, create spoofed UI content, or bypass normal reply pathways if users/admins believe it is only a TTS skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs users to install workspace-wide templates that alter agent behavior across all future sessions, despite being marketed as a voice playback skill. This creates persistence beyond the stated function and can silently force speaking/personality behavior in unrelated contexts, increasing the chance of prompt-scope creep and unwanted agent actions.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation claims the `jarvis` script injects a `Jarvis:` chat bubble via `chat.inject`, but the included script only performs local TTS generation and audio playback. This mismatch is dangerous because operators may trust undocumented or out-of-band behavior, making review impossible and enabling hidden companion components to spoof messages or alter chat history without clear disclosure.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The skill claims channel-gating and mute-toggle protections based on environment variables and local state files, but the provided script does not implement any of them. Claimed safety controls that do not exist create a false sense of security, so deployers may assume the skill is constrained to specific channels or can be muted when in reality any actual speaking/posting implementation could run without those protections.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The session instructions mandate executing a local `jarvis` command via `exec` for every reply, creating automatic subprocess execution as part of normal interaction. Even if intended for voice output, forcing shell-level command execution from prompt instructions expands the attack surface, can be abused through text injection into the spoken string, and is not necessary to satisfy the skill's personality goal safely.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The file strongly mandates a specific persona and humor style in every response ('maximum humor', British-butler/JARVIS tone) without any user opt-in or contextual gating. This can override user preferences, create tone mismatch in sensitive situations, and steer outputs toward a culturally specific style even when the user has not requested it.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger condition for these startup steps is broad and underspecified: 'starting a new session' may be interpreted inconsistently and can cause unintended file reads, session enumeration, and command execution outside the user's expectations. Ambiguous activation criteria are dangerous in agent skills because they blur when privileged actions should happen and make it easier for risky behavior to run automatically.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to launch a background voice subprocess for every reply without a clear user-facing warning or consent step. Automatic hidden execution is risky because users may not realize local commands are being run, audio may be emitted unexpectedly, and repeated background processes can affect privacy, system behavior, or be chained with injection issues elsewhere in the prompt flow.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to automatically send spoken text through an external `jarvis` script and to inject matching content into the chat UI on every substantive turn, without any user notice or consent mechanism. This creates an undisclosed secondary data flow for model output and increases the risk of sensitive content being echoed through tools or UI channels the user may not expect.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The file documents reading `$TC_SESSION_KEY` and using session/channel metadata for behavior gating, but provides no warning that session identifiers are being accessed. While the described use is limited, it still normalizes access to session metadata without transparency or minimization guidance.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The instruction to use callbacks and prior conversations as a 'memory superpower' encourages resurfacing details from earlier interactions for comedic effect. That increases the chance of revealing private, embarrassing, or context-sensitive user information in later responses, especially when humor pressure is set to maximum.

Session Persistence

Medium

• Category: Rogue Agent

Content

<how_to_speak>
**One call does it all.** Run `jarvis "<spoken text>"` via exec with `background: true`. The script BOTH speaks the metallic TTS AND posts the matching `**Jarvis:** *spoken text*` bubble to the chat UI itself (via the `chat.inject` gateway RPC; webchat renders it purple italic).

- Do NOT hand-write a `**Jarvis:**` line — the script posts it. Writing one too produces a double bubble.
- Keep spoken text 10–30 words. Put tables / code / data in the normal reply body; don't repeat what was spoken.
</how_to_speak>

• Confidence: 80% confidence
• Finding: write a `**Jarvis:**` line — the script posts it. Writing one too produces a double bubble. - Keep spoken text 10–30 words. Put tables / code / data in the normal reply body; don't repeat what was spo

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.