Listen

• Outcome: Pass
• Latest audit: Jul 26, 2026 · 12:50 PM UTC
• Version: 1.0.3

Overview

This skill coherently repairs voice transcription errors and stores local correction preferences, with no evidence of hidden exfiltration, unsafe installation, or deceptive behavior.

Before installing, be comfortable with the skill reading and writing local Listen files that may contain names, jargon, language preferences, and correction history. Use stricter confirmation settings if voice commands may send messages, delete data, post publicly, deploy, book, or pay, and periodically inspect or delete ~/Clawic/data/listen/ if you do not want old corrections retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The guidance instructs the skill to read `~/Clawic/profile.yaml` to infer a default currency, which introduces access to local user data beyond the core task of repairing speech-to-text errors. Even if limited to currency, this creates unnecessary data dependency and can normalize local file access in a text-repair skill, increasing privacy risk and the chance of unintended data exposure or overreach.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The instruction to 'produce the artifact' when activation is ambiguous can cause the system to treat ordinary conversational text as user-approved dictation and emit a polished message or document the user did not explicitly request. In a voice/STT context, ambiguity is common, so this increases the risk of unintended message composition, misrepresentation of user intent, and downstream accidental sending or logging of incorrect content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to read and later create persistent local files containing user preferences and correction history without requiring any user-facing notice or consent. This creates a privacy and transparency risk because the agent may access and retain personal data such as languages, names, jargon, and behavioral preferences without the user understanding that local storage is being used.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Defaulting to `languages: [en]` without user opt-in can cause the skill to silently process speech repairs under an incorrect language assumption. In a voice-repair context this can degrade accuracy, mis-handle names or commands, and potentially alter meaning in user messages, though it is primarily a reliability and fairness issue rather than a direct security exploit.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Core Rules

1. **Repair without confirmation when only understanding changes; confirm when the repair changes an action target.** Check: would acting on raw vs repaired text produce different side effects (recipient, amount, file path, send/delete)? Different side effects = confirm first. Same outcome = fix without asking and move on. Full ladder in `actions.md`.
2. **Confirm with a candidate, never an open question.** "Did you mean Kubernetes?" costs the user one word; "What did you say?" forces full re-dictation. Offer 1 candidate; 2 only when both fit equally; never 3.
3. **Two-strike promotion.** First observed fix = candidate: apply it but surface it ("...on Kubernetes, got it"). Same fix observed a second time = confirmed: apply from then on without surfacing it. One user rejection at any stage = move the pair to the Never list.
4. **Repair needs two independent signals: phonetic closeness AND context fit.** Phonetic test: fold confusable consonants (B/P, D/T, C/K/Q — full class table in `repair.md`), strip vowels, collapse doubles, then compare skeletons. "web look" → WPLK vs "webhook" → WPHK is skeleton edit distance 1 (one substitution, L/H); distance ≤2 = neighbor. Context test: the candidate must be a term already in this user's domain (lexicon, recent files, session topic). Either signal alone is a guess, not a repair.

• Confidence: 88% confidence
• Finding: The instruction to 'fix without asking' creates a pathway for the agent to silently rewrite user intent based on heuristic phonetic and contextual matching. Even though the skill attempts to exclude obvious side-effecting actions, silent semantic substitution can still corrupt dictated emails, notes, commands, or factual content and may propagate errors into later steps.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Core Rules

1. **Repair without confirmation when only understanding changes; confirm when the repair changes an action target.** Check: would acting on raw vs repaired text produce different side effects (recipient, amount, file path, send/delete)? Different side effects = confirm first. Same outcome = fix without asking and move on. Full ladder in `actions.md`.
2. **Confirm with a candidate, never an open question.** "Did you mean Kubernetes?" costs the user one word; "What did you say?" forces full re-dictation. Offer 1 candidate; 2 only when both fit equally; never 3.
3. **Two-strike promotion.** First observed fix = candidate: apply it but surface it ("...on Kubernetes, got it"). Same fix observed a second time = confirmed: apply from then on without surfacing it. One user rejection at any stage = move the pair to the Never list.
4. **Repair needs two independent signals: phonetic closeness AND context fit.** Phonetic test: fold confusable consonants (B/P, D/T, C/K/Q — full class table in `repair.md`), strip vowels, collapse doubles, then compare skeletons. "web look" → WPLK vs "webhook" → WPHK is skeleton edit distance 1 (one substitution, L/H); distance ≤2 = neighbor. Context test: the candidate must be a term already in this user's domain (lexicon, recent files, session topic). Either signal alone is a guess, not a repair.

• Confidence: 88% confidence
• Finding: The instruction to 'fix without asking' creates a pathway for the agent to silently rewrite user intent based on heuristic phonetic and contextual matching. Even though the skill attempts to exclude obvious side-effecting actions, silent semantic substitution can still corrupt dictated emails, notes, commands, or factual content and may propagate errors into later steps.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Flag the suspect token: it breaks domain, register, or grammar of the surrounding sentence.
2. Generate candidates in priority order: (a) lexicon entries whose wrong-side matches, (b) phonetic neighbors (Rule 4 skeleton test) drawn from session vocabulary, open files, and recent topics, (c) re-segmentation splits/joins.
3. Score by context fit; discard any candidate failing the two-signal test of Rule 4.
4. Route by Rule 1: side effects → confirm with the top candidate; understanding only → substitute without confirmation.
5. After user confirmation or correction, append the pair to the lexicon (`lexicon.md`).

Worked candidate generation, sound-class folding, segmentation repair, and the homophone catalog: `repair.md`.

• Confidence: 89% confidence
• Finding: The repair procedure instructs the system to substitute candidate terms without confirmation whenever it classifies the change as understanding-only. This is risky because the classification itself is fallible, and the procedure relies on lexicon and context signals that can be stale, biased, or wrong, causing the system to assert corrected content the user never intended.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.