Nex Voice

What to consider before installing: - The core functionality is coherent: the skill transcribes audio using Whisper and stores transcripts/actions under ~/.nex-voice. - If you enable the optional LLM feature (set an API key and use --use-llm), the skill will send transcripts to the configured API base. That is expected behavior but be aware it uploads your transcript data to that external service. - Implementation risk: the skill invokes curl with the API key on the command line. That can expose the API key to other users/processes on the same machine via process listings. If you plan to use LLM features, prefer to (a) not set an API key unless necessary, (b) use an ephemeral API key you can rotate, or (c) inspect and modify the code to use a secure HTTP client (requests) that sends the key in headers without exposing it on the command line. - The config file (~/.nex-voice/config.json) stores the API key in plaintext when you use config set-api-key; treat that file as sensitive and protect it with filesystem permissions or avoid storing keys there. - The setup.sh DB initialization step may be nonfunctional; verify the database is created after setup or run a manual initialization by running the CLI to save a recording. Review the setup.sh before running it. If you want to reduce risk: - Do not configure LLM/API key (use purely local Whisper). - Audit or patch lib/action_extractor.py:_extract_actions_llm to call the API via a library (requests) using environment or secure header handling rather than passing the key and transcript on the command line. - Keep data and the config file on a single-user, trusted machine; do not enable LLM features for sensitive transcripts unless you trust the external provider. Confidence note: medium — the code is readable and mostly matches its description, but the command-line curl usage and config storage choices raise clear security concerns that justify the 'suspicious' classification. If the LLM call used a secure HTTP client (no API key on the command line) and the setup.sh DB step was corrected, confidence would increase toward benign.