Listen

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:38 PM UTC
• Version: 1.0.3

Overview

The skill is coherent for repairing voice transcripts, but it asks the agent to use sensitive local context and persist learned corrections without enough user control.

Review before installing. Use it only if you are comfortable with a voice-repair skill reading local correction files and potentially consulting contacts, prior conversations, project identifiers, and profile settings. Prefer strict confirmation for actions, and periodically inspect or delete ~/Clawic/data/listen/ if it contains sensitive names, addresses, projects, or dictated phrases.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: repair.md:22

Finding

Overbroad Access to Contacts, Prior Conversations, Project Files, and Shared Profile Data

Content

View full analysis

`. - Transliterated names have no single right form ("Mohammed/Muhammad/Mohamed") — the user's chosen form is in the lexicon or their contacts; absent both, ask once. - Names the engine split ("Anna Lise" → "analyse") or fused ("johnsmith") re-enter via re-segmentation (`repair.md`). ``` From `names.md:31-32`: ```markdown - Candidate pool is the codebase itself: gre ...[truncated 3420 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The instruction to 'fix without asking' encourages the agent to make unverified semantic decisions on behalf of the user. In voice workflows, mistaken repairs can redirect intent, especially where distinctions between informational and action-oriented content are subtle, increasing the chance of silent misexecution or downstream data corruption.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

## Core Rules

1. **Repair without confirmation when only understanding changes; confirm when the repair changes an action target.** Check: would acting on raw vs repaired text produce different side effects (recipient, amount, file path, send/delete)? Different side effects = confirm first. Same outcome = fix without asking and move on. Full ladder in `actions.md`.
2. **Confirm with a candidate, never an open question.** "Did you mean Kubernetes?" costs the user one word; "What did you say?" forces full re-dictation. Offer 1 candidate; 2 only when both fit equally; never 3.
3. **Two-strike promotion.** First observed fix = candidate: apply it but surface it ("...on Kubernetes, got it"). Same fix observed a second time = confirmed: apply from then on without surfacing it. One user rejection at any stage = move the pair to the Never list.
4. **Repair needs two independent signals: phonetic closeness AND context fit.** Phonetic test: fold confusable consonants (B/P, D/T, C/K/Q — full class table in `repair.md`), strip vowels, collapse doubles, then compare skeletons. "web look" → WPLK vs "webhook" → WPHK is skeleton edit distance 1 (one substitution, L/H); distance ≤2 = neighbor. Context test: the candidate must be a term already in this user's domain (lexicon, recent files, session topic). Either signal alone is a guess, not a repair.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The instruction to 'fix without asking' encourages the agent to make unverified semantic decisions on behalf of the user. In voice workflows, mistaken repairs can redirect intent, especially where distinctions between informational and action-oriented content are subtle, increasing the chance of silent misexecution or downstream data corruption.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

## Core Rules

1. **Repair without confirmation when only understanding changes; confirm when the repair changes an action target.** Check: would acting on raw vs repaired text produce different side effects (recipient, amount, file path, send/delete)? Different side effects = confirm first. Same outcome = fix without asking and move on. Full ladder in `actions.md`.
2. **Confirm with a candidate, never an open question.** "Did you mean Kubernetes?" costs the user one word; "What did you say?" forces full re-dictation. Offer 1 candidate; 2 only when both fit equally; never 3.
3. **Two-strike promotion.** First observed fix = candidate: apply it but surface it ("...on Kubernetes, got it"). Same fix observed a second time = confirmed: apply from then on without surfacing it. One user rejection at any stage = move the pair to the Never list.
4. **Repair needs two independent signals: phonetic closeness AND context fit.** Phonetic test: fold confusable consonants (B/P, D/T, C/K/Q — full class table in `repair.md`), strip vowels, collapse doubles, then compare skeletons. "web look" → WPLK vs "webhook" → WPHK is skeleton edit distance 1 (one substitution, L/H); distance ≤2 = neighbor. Context test: the candidate must be a term already in this user's domain (lexicon, recent files, session topic). Either signal alone is a guess, not a repair.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The repair procedure operationalizes autonomous substitution without confirmation and then persists corrections after confirmation or correction, which can amplify a single bad inference into repeated future misinterpretations. Because the candidate pool includes session vocabulary, open files, and recent topics, the model may overfit context and silently choose the wrong target.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

1. Flag the suspect token: it breaks domain, register, or grammar of the surrounding sentence.
2. Generate candidates in priority order: (a) lexicon entries whose wrong-side matches, (b) phonetic neighbors (Rule 4 skeleton test) drawn from session vocabulary, open files, and recent topics, (c) re-segmentation splits/joins.
3. Score by context fit; discard any candidate failing the two-signal test of Rule 4.
4. Route by Rule 1: side effects → confirm with the top candidate; understanding only → substitute without confirmation.
5. After user confirmation or correction, append the pair to the lexicon (`lexicon.md`).

Worked candidate generation, sound-class folding, segmentation repair, and the homophone catalog: `repair.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The skill explicitly allows previously confirmed lexicon entries to bypass confirmation for reversible, read-only, and some local actions. In a voice-repair context, that creates autonomous decision-making risk because stale, incorrect, or over-broad lexicon mappings can silently influence operational commands, especially when transcript quality or speaker attribution is uncertain.

Content

Scanner excerpt · actions.md (reported line 41)May include surrounding context.

md

## Interplay With the Lexicon

`confirmed` lexicon entries skip confirmation on the ladder's lower three rungs — that is what confirmation earned. The top rung (irreversible + external) still echoes the resolved value in the action sentence itself under `standard` posture, and asks under `strict`. A lexicon hit never exempts a high-risk field from being stated aloud.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guidance explicitly says to produce an artifact when dictation is ambiguous and to assume the user can easily correct a mistaken mode choice. That can cause the agent to transform ordinary conversation into authoritative-looking drafted content, potentially introducing unintended text, recipients, dates, or commitments that the user did not intend to create.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to move data from older directories to a new location describes modifying local files without warning the user that existing data will be relocated and may affect backups, permissions, or expectations about where sensitive data resides. While not an exploit by itself, it creates integrity and privacy risk through undisclosed file-system changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill’s stated purpose is repairing garbled STT text, but this instruction expands scope to reading a local profile file for currency fallback. Accessing local user data that is not necessary for text repair violates least privilege and can expose sensitive profile information or create a precedent for unnecessary filesystem access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Looking up stored contacts to resolve or override a reassembled email address goes beyond transcription repair into personal data access and autonomous recipient selection. This can leak address-book information, cause unintended disclosure of contacts, or send messages to the wrong recipient based on fuzzy matching.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file sets languages: [en] as the default and explicitly instructs the skill to avoid opening questions about languages. This imposes a language choice by default without user opt-in, which is a natural-language locale policy concern under the stated rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to persist user preferences and behavioral observations to local files, but provides no user-facing disclosure, consent step, or retention notice. Even though the storage is framed as convenience, silently recording preferences, field information, spelling conventions, and corrections creates a privacy risk and can accumulate sensitive personal or professional data without the user's awareness.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · setup.md (reported line 30)May include surrounding context.

md

## What the Lexicon Holds

Observed corrections, not declared preferences — the two never mix (`lexicon.md`). Correction pairs and Never-list entries accumulate from real exchanges only; an observation never overwrites a declared preference without confirmation.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Lines L13-L14 direct the operator to explicitly pin the language for users, including multilingual users, based on a stored languages list. This imposes a language/locale choice on the user without indicating consent, opt-in, or an option to select a different language, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The description states error rates for conversational English and frames the skill behavior around English as the default operating language. Although multilingual handling is mentioned later, the default language configuration remains English-centric without explicit user opt-in at the point of behavior description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction to move data from older directories to a new location describes modifying local files without warning the user that existing data will be relocated and may affect backups, permissions, or expectations about where sensitive data resides. While not an exploit by itself, it creates integrity and privacy risk through undisclosed file-system changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file recommends storing a fixed test sentence in ~/Clawic/data/listen/config.yaml without caution about what that sentence may contain. Because the sentence is built from a user's known problem terms, it could embed names, project identifiers, email-like strings, or other user-specific vocabulary and persist it on disk, creating an avoidable privacy exposure if the machine is shared, backed up, or compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.