macOS Voice Messages
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, README, and runtime instructions are consistent with a macOS-local TTS/STT provider that uses a local CLI (voicecli) and ffmpeg; no unexpected network endpoints, secrets, or broad privileges are requested — but there are a few small inconsistencies and a logic bug you should be aware of before installing.
This plugin appears to do what it says: local macOS TTS and STT via the voicecli CLI and optional ffmpeg conversion. Before installing: 1) Confirm you're on macOS 13+ and install voicecli (and ffmpeg if you want OGG/Opus output) using the SKILL.md brew commands; 2) Run the first-time setup steps to trigger macOS Microphone and Speech permissions; 3) Be aware of a logic bug in src/dist: the code's getVoiceCliPath() design causes isConfigured() to return true even when voicecli isn't actually present (it falls back to the literal 'voicecli' string). In practice this can make the plugin appear 'available' when the required CLI is missing; verify voicecli is on PATH or at the expected Homebrew path after installation; 4) Temporary audio/text files are written to a configurable tempDir (default under system tmp); if you have security concerns set tempDir to a location you control and monitor cleanup; 5) The repository's CI/release workflows reference standard CI tokens (GITHUB_TOKEN, NPM_TOKEN, CLAWHUB_TOKEN) — these are for publishing and are not used at runtime. If you trust the voicecli project and intend to run local speech features on macOS, this plugin is coherent and reasonable to use. If you want extra assurance, inspect the voicecli binary/source you install and verify that it does not send audio or text to remote services.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings