Security audit

Jarvis Voice

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about adding a JARVIS-style voice, but it persistently changes future sessions and automatically runs a local voice command that sends reply text to an external TTS service.

Install only if you want future OpenClaw sessions to auto-load these templates, run a local `jarvis` command automatically, play audio, and send spoken reply text to SkillBoss. Review the actual `jarvis` executable on your PATH, protect the SkillBoss API key, and avoid enabling this in private, shared, or compliance-sensitive workspaces unless you add your own mute/confirmation controls.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a voice/personality add-on, but it instructs users to copy persistent workspace files that auto-load in future sessions and alter agent behavior beyond transient voice playback. This creates an unnecessary persistence mechanism that can silently change future agent responses and expands the trust boundary far beyond the advertised function.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill bundles persistent humor and personality injection files that influence future sessions, even though those controls are not strictly required for text-to-speech playback. This over-broad behavioral modification increases the chance of policy drift, prompt interference, and hard-to-audit agent behavior across unrelated tasks.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill tells the agent to automatically execute a local shell command in the background for every qualifying response, which sends user-visible content to a third-party TTS service and triggers local audio playback. Because this happens at the point of response generation without a contemporaneous warning or consent step, users may unknowingly cause sensitive content to be transmitted externally and executed through shell tooling.

Natural-Language Policy Violations

High

Confidence: 87% confidence
Finding: Mandating English-only speech and forcing translation or summarization without user opt-in can cause unauthorized transformation of user content before it is sent to the external TTS provider. This may alter meaning, mishandle sensitive multilingual content, and violate user expectations or compliance requirements around fidelity and language handling.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill explicitly mandates a culturally specific voice ("we're British, we don't do that") without any user opt-in or adaptation mechanism. This is not a code-execution risk, but it is a genuine policy/control issue because it can override user preference, reduce inclusivity, and cause the agent to respond in ways that are misaligned with the user's expectations or identity.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to execute a local subprocess (`jarvis "<text>"` via exec) on every reply, including automatically at session start, without explicit user consent or clear disclosure that code/process execution will occur. This creates a persistent command-execution pathway tied to normal conversational output, increasing the chance of unintended execution, abuse through prompt/content injection into spoken text, or operation in environments where subprocess execution is unsafe or disallowed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file instructs the agent to run a local `jarvis` command via exec for every response, creating undisclosed subprocess execution and audio playback side effects. Even if the wrapper is intended for TTS, mandatory execution without user consent or warning can leak response content to external services, trigger unexpected system behavior, and violate least-surprise expectations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill mandates spoken audio on every response but does not warn users that all outputs may be converted to speech and played locally or sent through a TTS backend. In this context, the omission is security-relevant because users may unknowingly expose sensitive prompts, model outputs, or environmental details through audio generation and playback.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file enforces a single always-on voice mode with 'No exceptions,' removing user choice and preventing safer operation in privacy-sensitive or non-audio environments. This increases risk because any interaction, including sensitive or secret-bearing responses, will trigger the voice pipeline regardless of context or user preference.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:129