Walkie-Talkie Mode

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:48 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: handle WhatsApp voice-note conversations locally, with some setup and privacy caveats users should understand.

Before installing, confirm you want incoming WhatsApp audio to be transcribed and answered automatically in the chats where this skill is active. Prefer a per-request temporary audio file instead of /tmp/reply.ogg, and avoid using it for sensitive conversations unless all participants expect voice notes to be processed by the agent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32

Finding

Predictable Shared Temporary File Enables Cross-Session Audio Replacement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–36
Vulnerability Type: Predictable and insecure temporary file usage
Risk Level: Medium

Vulnerable Code

bash

## Manual Execution (Internal)

To respond with voice manually:
```bash
bin/sherpa-onnx-tts /tmp/reply.ogg "Tu mensaje aquí"

Then send /tmp/reply.ogg via message tool with filePath.

text

### Technical Analysis

The manual workflow directs every invocation to write synthesized audio to the same predictable path, `/tmp/reply.ogg`, and subsequently sends that file to the user. Because `/tmp` is ordinarily shared and the filename is neither unique nor isolated per request, concurrent or malicious local activity can interfere with the output.

Two principal exploitation conditions may arise:

1. **Request collision:** Concurrent skill executions can overwrite the same file. One conversation may consequently receive audio generated for another conversation.
2. **Filesystem pre-positioning:** A local attacker able to write in `/tmp` may create or replace the predictable path before generation or before transmission. Depending on how `sherpa-onnx-tts` opens output files and the process privileges, this may permit replacement of the transmitted audio or redirection through a symbolic link.

The referenced TTS executable is not included in the audited project, so its symlink-handling behavior cannot be verified. Nevertheless, the documented use of a fixed shared temporary path creates a confirmed collision and file-substitution weakness.

### Attack Path

1. An attacker predicts the documented output path `/tmp/reply.ogg`.
2. The attacker pre-creates, replaces, or repeatedly modifies that path, or causes two skill requests to execute concurrently.
3. The skill invokes `bin/sherpa-onnx-tts` using the shared path.
4. Before the `message` tool reads the output, the attacker or another request replaces or overwrites the file.
5. 
...[truncated 858 chars]

Remediation

View remediation

Remediation Suggestions

• Create a private temporary directory for each invocation using a secure facility such as mktemp -d.
• Generate a unique output filename within that directory rather than using a fixed path.
• Restrict directory and file permissions to the executing account, preferably with directory mode 0700 and file mode 0600.
• Open output files using mechanisms that reject symbolic links and fail if a file already exists.
• Keep the unique path associated with the originating request so concurrent conversations cannot share output state.
• Send the file through an already-open descriptor where supported, or validate immediately before transmission that it remains a regular file owned by the expected account.
• Delete the generated audio and private temporary directory after transmission, including cleanup on error or cancellation.
• Pass TTS text as a structured process argument rather than constructing commands through shell interpolation.

A hardened shell workflow could use the following pattern:

bash

tmp_dir="$(mktemp -d)"
chmod 700 "$tmp_dir"
trap 'rm -rf -- "$tmp_dir"' EXIT

output_file="$tmp_dir/reply.ogg"
bin/sherpa-onnx-tts "$output_file" "$reply_text"
chmod 600 "$output_file"

The resulting unique output_file should then be supplied directly to the messaging tool for the corresponding request.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill enables automatic transcription and automatic voice/text replies for incoming WhatsApp audio, but it does not warn users or operators that voice messages will be automatically processed and answered. This can cause privacy, consent, and surprise-automation issues, especially if sensitive audio is transcribed locally and responded to without clear user awareness or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documented activation phrases and TTS example are in Spanish only, which implies a language-specific interaction model. The file does not state that the skill is intentionally limited to Spanish or provide an option for users to choose another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.