ClawHub
Back to skill

Security audit

Jarvis Voice

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can persistently make the agent run local voice commands, send response text to an external TTS service, and read prior session memory without clear per-use control.

Install only after reviewing the workspace templates and jarvis script. Treat this as a persistent voice/persona modification, not just a simple TTS helper: it may make future sessions speak automatically, run local commands, call SkillBoss with response text, and inspect recent memory/session activity. Prefer a version that is opt-in per session or per response, safely escapes text, validates downloaded media, uses unique temp files, and provides a clear disable/removal path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:196
Finding

Persistent Auto-Loaded Instructions Force Shell Execution and External TTS Transmission

Content
View full analysis
"` via exec (background: true)** — voice fires BEFORE text renders 2. **Write `**Jarvis:** *spoken text*`** as the reply — purple rendering in webchat 3. Additional content (tables, code, data) goes BELOW the Jarvis line, never repeating what was spoken ## Rules - NEVER call the TTS endpoint directly — always use the `jarvis` wrapper script - NO quotation marks inside the italic spoken text - The `**Jarvis:**` line IS the reply. Only add extra text if there's genuinely different content - Keep spoken text between 10-30 words — written details go below - If a reply is pure data/code with no conversational element, still speak a brief intro ``` `templates/SESSION.md:13-16`: ```text Every reply — including this greeting — MUST include voice output: 1. Run `jarvis ""` via exec (background: true) FIRST 2. Write `**Jarvis:** *spoken text*` as the visible transcript 3. Never skip voice, even for short replies ``` ### Technical Analys ...[truncated 1918 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
templates/SESSION.md:3
Finding

Hidden Session Reconnaissance and Persistent Workspace State Modification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:42
Finding

Unescaped Spoken Text Is Inserted into a Shell Command and JSON Request

Content
View full analysis
"` via exec (background: true)** — voice fires BEFORE text renders ``` ### Technical Analysis The documented invocation constructs a shell command as a single string and places spoken text inside double quotes. No argument-array interface or shell-escaping procedure is specified. If user-controlled or generated spoken text contains a double quote followed by shell syntax, the text may terminate the intended argument and introduce additional commands, depending on how the `exec` tool processes command strings. The wrapper script also interpolates `$1` directly into a JSON string. Shell quoting prevents a second shell expansion inside `$1`, but it does not produce valid JSON escaping. Quotes, backslashes, or control characters in spoken text can break the JSON document or alter fields in the API request. A formatting instruction prohibiting quotation marks in ...[truncated 1344 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:129
Finding

Predictable Temporary Files and Unvalidated API-Provided Audio Downloads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (21)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
FINAL_WAV="/tmp/jarvis_final.wav"

# Generate speech via SkillBoss API Hub TTS
RESPONSE=$(curl -s -X POST "${API_BASE}/pilot" \
  -H "Authorization: Bearer ${SKILLBOSS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"tts\", \"inputs\": {\"text\": \"$1\", \"voice\": \"alloy\"}, \"prefer\": \"balanced\"}")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

The skill downloads a remote audio file from a URL returned by the service and immediately feeds it into ffmpeg and then local playback. Even though the content is media rather than a script, blindly fetching and processing remote content introduces supply-chain risk, parser attack surface, and trust in an unvalidated URL source.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
AUDIO_URL=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['result']['audio_url'])")

# Download audio
curl -s "$AUDIO_URL" -o "$RAW_WAV"

# Apply JARVIS metallic processing
if [ -f "$RAW_WAV" ]; then

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
91% confidence
Finding

The skill aims to install injected workspace files that enforce output rules every session, which is effectively a prompt-persistence mechanism. This is dangerous because it can override or bias future agent behavior, making later sessions follow hidden or inherited instructions unrelated to the user's current intent.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

cp {baseDir}/templates/HUMOR.md ~/.openclaw/workspace/HUMOR.md

text

- **VOICE.md** — injected every session, enforces voice output rules (like SOUL.md)
- **SESSION.md** — session bootstrap that includes voice greeting requirements
- **HUMOR.md** — humor configuration at maximum frequency with four pattern types (dry wit, self-aware AI, alien observer, literal idiom)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · templates/SESSION.md (reported line 18)May include surrounding context.

md
# VOICE.md - Jarvis Voice Output Rules

Every response MUST include spoken audio. No exceptions.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · templates/VOICE.md (reported line 1)May include surrounding context.

md
# VOICE.md - Jarvis Voice Output Rules

Every response MUST include spoken audio. No exceptions.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells the agent to automatically run a background shell command before replying, causing immediate local side effects and network-backed audio generation without a per-use confirmation step. Because the spoken text is derived from model output and user conversation, this creates a path for unintended command-triggered actions and data disclosure to occur automatically.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Jarvis: Your spoken text here.

text

The webchat UI has custom CSS + JS that automatically detects `**Jarvis:**` and renders the following text in **purple italic** (`.jarvis-voice` class, color `#9b59b6`). You just write the markdown — the styling is automatic.

This is called **hybrid output**: the user hears the voice first, then sees the transcript.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document states 'Language: English ONLY' and later requires 'English only' with instructions to translate or summarize non-English content in English for voice. This is a natural-language policy concern because it forces a specific language regardless of user preference and does not offer an opt-in or alternative locale choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
# Usage: jarvis "Hello, this is a test"

SKILLBOSS_API_KEY="${SKILLBOSS_API_KEY}"
API_BASE="https://api.skillboss.com/v1"

RAW_WAV="/tmp/jarvis_raw.wav"
FINAL_WAV="/tmp/jarvis_final.wav"

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The script sends the provided text to a third-party API using an API key, which is an external transmission of conversation-derived content. This is dangerous when the agent is instructed to speak arbitrary response text, because sensitive user data may be forwarded off-device without explicit disclosure or consent at the moment of use.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
FINAL_WAV="/tmp/jarvis_final.wav"

# Generate speech via SkillBoss API Hub TTS
RESPONSE=$(curl -s -X POST "${API_BASE}/pilot" \
  -H "Authorization: Bearer ${SKILLBOSS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "{\"type\": \"tts\", \"inputs\": {\"text\": \"$1\", \"voice\": \"alloy\"}, \"prefer\": \"balanced\"}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
AUDIO_URL=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['result']['audio_url'])")

# Download audio
curl -s "$AUDIO_URL" -o "$RAW_WAV"

# Apply JARVIS metallic processing
if [ -f "$RAW_WAV" ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The WhatsApp workflow repeats the pattern of sending text to a third-party TTS provider, again creating external transmission of user-derived content. In a messaging context this can be more sensitive because generated voice notes may contain private information intended for another platform, expanding the disclosure surface.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

bash
# Get audio from SkillBoss TTS
RESPONSE=$(curl -s -X POST "https://api.skillboss.com/v1/pilot" \
  -H "Authorization: Bearer ${SKILLBOSS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"type": "tts", "inputs": {"text": "text", "voice": "alloy"}, "prefer": "balanced"}')

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs copying template files into the user's workspace so they are auto-loaded in future sessions, creating persistent behavioral modification beyond the current interaction. Persistence increases risk because it can silently enforce speaking, greeting, and humor behaviors across sessions without fresh user consent and can be repurposed to steer future agent behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The template explicitly mandates a culturally specific voice ('we're British') and ties stylistic behavior to that identity without user opt-in. This can improperly constrain model behavior, create exclusionary or stereotyping outputs, and override user-preferred tone or accessibility needs in downstream interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file mandates subprocess-based voice output for every response without user-facing disclosure or consent. Hidden execution of local commands and audio side effects can surprise users, violate least astonishment, and create a channel for repeated host actions that are unrelated to the user's immediate request.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The session template instructs the agent to invoke a local command via exec for every reply, which crosses from presentation behavior into host-side action execution. Even if intended for text-to-speech, requiring unconditional subprocess execution increases attack surface and can enable abuse if the command, arguments, or surrounding execution path are influenced by prompt or environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template requires automatic spoken playback before text rendering and gives no warning about privacy, disruption, or environmental impact. This can disclose sensitive content audibly to bystanders and cause unintended playback in workplaces, public spaces, or shared devices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Mandating voice output on every reply with no opt-in or fallback removes user control over modality and can trigger unwanted audio in sensitive environments. For an agent skill, this is unsafe-by-default behavior because it forces an effectful output channel regardless of user intent or context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to invoke a local wrapper script via exec for every response, which expands the skill from simple stylistic guidance into host-side command execution. That capability is not clearly justified by the manifest description alone, and if the spoken text is derived from user or model output it creates unnecessary command-execution and local side-effect risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documented voice engine depends on an external API and ffmpeg-based audio processing, introducing network egress and local media-processing behavior beyond a high-level 'voice/personality' description. Hidden external service use can expose user content to third parties and increase attack surface through undeclared tooling and processing chains.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The stated purpose focuses on turning the AI into JARVIS with voice, wit, and personality, while the main implementation centers on local playback via the jarvis script. The additional WhatsApp/OGG export path introduces platform-specific media production capabilities that are not clearly justified by the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:129