Security audit

Jarvis Voice

Security checks for vulnerabilities and agentic risk

Overview

This is a real voice/personality skill, but it makes routine chat replies run a local command, send text to a cloud TTS service, and persist behavior across future sessions.

Install only if you want an always-on voice mode and are comfortable with each reply potentially invoking a local `jarvis` executable, sending spoken text to SkillBoss, and playing audio automatically. Review and pin the exact `jarvis` script before putting it in PATH, protect the API key, and avoid copying the workspace templates if you do not want persistent voice, humor, memory reads, or daily-log behavior.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill goes beyond one-off voice playback and instructs users to install persistent workspace injection files that alter future agent behavior every session. That creates a lasting prompt-surface expansion where additional rules can influence responses, increase attack surface, and make later unsafe behavior harder to attribute or disable.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The session instructions mandate executing a local `jarvis` command for every reply, which expands the skill from formatting/personality into unconditional subprocess execution. Even if the command is intended for text-to-speech, requiring automatic execution on every turn increases attack surface, can be abused through prompt-influenced spoken content, and is not clearly justified by the skill description alone.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a voice/personality enhancement, but the session bootstrap also instructs the agent to read daily memory logs, inspect session activity, and create logs. That is a material scope expansion into workspace inspection and persistence, which can expose sensitive context and create hidden state changes that users would not reasonably expect from a 'voice' skill.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs the agent to execute a local shell command and trigger network-backed TTS before rendering each qualifying reply, without requiring contemporaneous user consent. This can cause silent data egress of reply content to a third-party API and automatic local command execution on routine interactions.

Natural-Language Policy Violations

High

Confidence: 88% confidence
Finding: Forcing English-only output and translation without user approval can transform user-provided or tool-derived content before transmission and presentation. While not a classic system-compromise issue, it can misrepresent content, bypass user intent, and create privacy or integrity concerns when multilingual data is silently reformulated.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill hard-codes a specific cultural/personality style ('we're British, we don't do that') and broader mandatory humor rules without user opt-in. This can override user-preferred tone, create exclusionary or culturally prescriptive behavior, and reduce safe adaptability in sensitive contexts where neutral language is more appropriate.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The markdown instructs the agent to perform subprocess execution for voice output without notifying the user that a local command will run. Hidden execution is risky because users cannot meaningfully consent to or assess the side effects of local process spawning, and the command may process untrusted text derived from prompts or workspace content.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file instructs the agent to execute a local `jarvis` command in the background for every response, which creates subprocess execution side effects without any user consent or visibility. Even if intended for benign TTS, forcing automatic command execution from prompt content increases the attack surface and can normalize hidden system actions triggered by ordinary conversation.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The instruction 'Every response MUST include spoken audio' forces a single modality regardless of user preference, environment, accessibility needs, or safety expectations. This can cause unwanted audio disclosure in shared spaces and prevents safe fallback to text-only interaction.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:129