Security audit

Jetson CUDA Voice

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real voice-assistant skill, but it needs review because it runs an always-listening microphone, sends voice data to cloud services, controls Home Assistant devices, and contains serious credential and authentication weaknesses.

Install only after reviewing the cloud data flows and device-control permissions. Rotate any embedded credentials, require explicit user-provided secrets, use HTTPS or localhost-only Home Assistant endpoints with least-privilege tokens, make speaker verification fail closed, avoid joblib/pickle loading from untrusted writable paths, and do not run it as an always-on service unless the microphone and cloud-processing behavior are acceptable.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/voice_pipeline.py:348
Finding: Multiple live-looking API credentials are hardcoded in source code and documentation
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/voice_pipeline.py:343
Finding: Microphone audio, transcripts, conversation history, and response text are sent to cloud services despite offline positioning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/voice_pipeline_v2.py:313
Finding: Sensitive voice recordings and biometric enrollment samples are retained under predictable temporary paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/speaker_verification.py:76
Finding: Speaker verification fails open and permits commands after verification errors
Content: View full analysis
= threshold return is_verified, score, threshold except Exception as e: print(f"Verification error: {e}") return True, 0.0, 0.0 # Fail-safe to true on system errors ``` The caller also continues after verification exceptions: ```python try: from speaker_verification import verify_speaker if os.path.exists("/home/manos/.openclaw/workspace/voice/manos_voice_model.joblib"): with open("/tmp/last_command.wav", "rb") as f: last_wav_bytes = f.read() verified, score, thresh = verify_speaker(last_wav_bytes) if not verified: ... continue except Exception as e: log.error(f"Speaker verification error: {e}") log.info(f"🤖 Processing: {text}") reply, ha_cmd = ask_alfred(text) ``` ### Technical Analysis Authentication returns success when the model is absent and when model loading, feature extraction, or scoring raises an exception. The caller similarly logs verification exceptions but proceeds to process the command. These are fail-open behaviors ...[truncated 1463 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/speaker_verification.py:80
Finding: Untrusted joblib model deserialization can execute arbitrary code as the service user
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/voice_pipeline_v2.py:717
Finding: Home Assistant bearer credentials and control commands are transmitted over plaintext HTTP by default
Content: View full analysis
`. 3. An attacker with LAN observation or man-in-the-middle capability captures the HTTP request. 4. The attacker extracts the b ...[truncated 571 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (95)

Tainted flow: 'ALFRED_TIMEOUT' from os.environ.get (line 63, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/voice_pipeline.py (reported line 398)May include surrounding context.
python
_chat_history = _chat_history[-10:] try: resp = requests.post( _OPENROUTER_URL, headers={"Authorization": f"Bearer {_OPENROUTER_KEY}", "Content-Type": "application/json"},

Tainted flow: 'GROQ_API_KEY' from os.environ.get (line 54, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 99% confidence
Finding: This code transmits captured voice audio to Groq's external STT service, contradicting the skill's 'offline' description and exposing sensitive spoken content to a third party. In a voice-assistant context, commands may contain private household information, credentials, or behavioral data, making this materially risky even if the API key flow itself is normal.
Content: Scanner excerpt · scripts/voice_pipeline_v2.py (reported line 331)May include surrounding context.
python
log.warning(f"Could not save last command WAV: {e}") # Call Groq API resp = requests.post( "https://api.groq.com/openai/v1/audio/transcriptions", headers={"Authorization": f"Bearer {GROQ_API_KEY}"}, files={"file": ("audio.wav", wav_io, "audio/wav")},

Tainted flow: 'gateway_url' from os.environ.get (line 592, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The code sends user voice-derived prompts to an HTTP-configurable gateway URL, which may forward them to another agent with tool access. Because the endpoint is environment-controlled and defaults to localhost but can be redirected, sensitive commands can be exfiltrated or routed to an untrusted service without clear safeguards.
Content: Scanner excerpt · scripts/voice_pipeline_v2.py (reported line 601)May include surrounding context.
python
) try: resp = requests.post( f"{gateway_url}/tools/invoke", headers={ "Authorization": f"Bearer {gateway_token}",

Tainted flow: 'url' from os.environ.get (line 726, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: This sends device-control requests plus a bearer token to a configurable Home Assistant URL, so if HA_URL is changed to an attacker-controlled host the token and command data could be exposed. In this skill, that could enable unauthorized smart-home control or token theft affecting the broader home-automation environment.
Content: Scanner excerpt · scripts/voice_pipeline_v2.py (reported line 727)May include surrounding context.
python
# Call HA API url = f"{HA_URL}/api/services/{service}" resp = requests.post( url, headers={"Authorization": f"Bearer {HA_TOKEN}", "Content-Type": "application/json"},

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The combination of 'offline voice pipeline' marketing with described external LLM/gateway usage and an always-listening microphone materially understates the privacy and capability surface. In this context, omitted disclosure around network APIs, device control, and sensitive voice-related processing makes the skill more dangerous because users are likely to deploy it on personal, always-on hardware inside homes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The combination of 'offline voice pipeline' marketing with described external LLM/gateway usage and an always-listening microphone materially understates the privacy and capability surface. In this context, omitted disclosure around network APIs, device control, and sensitive voice-related processing makes the skill more dangerous because users are likely to deploy it on personal, always-on hardware inside homes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The combination of 'offline voice pipeline' marketing with described external LLM/gateway usage and an always-listening microphone materially understates the privacy and capability surface. In this context, omitted disclosure around network APIs, device control, and sensitive voice-related processing makes the skill more dangerous because users are likely to deploy it on personal, always-on hardware inside homes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The combination of 'offline voice pipeline' marketing with described external LLM/gateway usage and an always-listening microphone materially understates the privacy and capability surface. In this context, omitted disclosure around network APIs, device control, and sensitive voice-related processing makes the skill more dangerous because users are likely to deploy it on personal, always-on hardware inside homes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The combination of 'offline voice pipeline' marketing with described external LLM/gateway usage and an always-listening microphone materially understates the privacy and capability surface. In this context, omitted disclosure around network APIs, device control, and sensitive voice-related processing makes the skill more dangerous because users are likely to deploy it on personal, always-on hardware inside homes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The combination of 'offline voice pipeline' marketing with described external LLM/gateway usage and an always-listening microphone materially understates the privacy and capability surface. In this context, omitted disclosure around network APIs, device control, and sensitive voice-related processing makes the skill more dangerous because users are likely to deploy it on personal, always-on hardware inside homes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The notes document a voice pipeline that sends audio to external cloud providers and couples the assistant to remote Home Assistant control, which materially exceeds the stated 'offline Jetson' scope. That mismatch can mislead reviewers and users about data flows and trust boundaries, increasing the risk of unauthorized disclosure of voice data and unintended device control.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Reading Home Assistant tokens from local config and using them to issue REST control commands grants the pipeline access to sensitive credentials and direct control over connected devices. In a voice assistant context, this is particularly dangerous because misrecognition, prompt manipulation, or abuse of the LLM-to-command path can trigger unauthorized actions in the physical environment.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/manage.sh (reported line 66)May include surrounding context.
sh
edge-tts --voice en-US-AndrewNeural --text "Alfred voice pipeline test successful." \ --write-media /tmp/alfred-test.mp3 --write-subtitles /dev/null mpg123 -q -a hw:C2c,0 /tmp/alfred-test.mp3 rm -f /tmp/alfred-test.mp3 ;; test-mic)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/manage.sh (reported line 90)May include surrounding context.
sh
" echo "▶ Playing back recording..." aplay -q -D plughw:C2c,0 /tmp/alfred-mic-test.wav rm -f /tmp/alfred-mic-test.raw /tmp/alfred-mic-test.wav ;; test-stt)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: When no model file exists, verify_speaker() returns (True, 0.0, 0.0), granting verification success instead of denying access or signaling an unenrolled state. In a voice-gated system, this creates a trivial authentication bypass: deleting, renaming, or preventing creation of the model file disables the protection entirely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The exception handler returns successful verification on any system error, including corrupted model files, deserialization problems, malformed audio handling, or runtime faults. An attacker who can trigger such errors can bypass speaker verification without matching the enrolled voice, undermining the entire security control.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script labeled as part of an 'offline' voice pipeline performs live network checks against Groq, Anthropic, and Home Assistant, which expands the trust boundary and can transmit credentials or data off-device. This is not just a documentation mismatch: users may run it expecting offline-only behavior, but it validates and exercises external integrations with real tokens.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_v2_pipeline.sh (reported line 71)May include surrounding context.
sh
SIZE=$(stat -f%z /tmp/alfred-test.raw 2>/dev/null || stat -c%s /tmp/alfred-test.raw 2>/dev/null || echo 0) if [ "$SIZE" -gt 1000 ]; then echo "✅ Mic recording successful ($SIZE bytes)" rm /tmp/alfred-test.raw else echo "❌ Mic recording too small" fi

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hardcoded fallback Anthropic API key is a real secret-handling vulnerability. Embedding a usable credential in source code enables unauthorized use, accidental redistribution, billing abuse, and makes operators unknowingly send requests under someone else's account.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file advertises a 'fully offline' voice pipeline, but the implementation sends captured microphone audio to Groq and sends conversation text to OpenRouter. This is dangerous because users and operators may make trust and privacy decisions based on false offline claims, causing sensitive voice data to be exfiltrated unexpectedly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The comments state that only the Claude API requires internet, but the code also uploads audio to Groq Whisper for transcription. Hidden additional network paths increase privacy and compliance risk because operators cannot accurately assess what data leaves the device.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The STT section is described as offline/local, yet the actual transcription code posts audio to a remote Groq endpoint. This mismatch is especially dangerous in a voice skill because raw microphone captures can contain highly sensitive personal or environmental information.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code transmits recorded microphone audio to an external transcription API without clear just-in-time disclosure to the user. In a voice-assistant context this is particularly sensitive because users may reasonably expect local processing based on the skill description, while private speech is actually being uploaded off-device.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: A hardcoded bearer token for a third-party transcription service is embedded directly in source code. This is dangerous because anyone with source or log access can reuse the credential, incur charges, impersonate the service identity, or access associated account resources.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The header markets the pipeline as 'offline', yet the implementation sends audio, prompts, and search queries to multiple external services. This mismatch is dangerous because users and operators may make trust and privacy decisions based on the false assumption that voice data never leaves the device.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/VOICE_PIPELINE_NOTES.md:269

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/voice_pipeline_v2.py:419