Security audit

Voice Builder

Security checks across malware telemetry and agentic risk

Overview

This skill is a text-only voice-analysis guide whose main privacy risk is asking users for real samples that may include private messages or transcripts.

Before installing or using it, treat any samples as sensitive: use writing you created or are authorized to share, get consent for recordings or private conversations when applicable, and redact names, contact details, customer data, and confidential business information before generating voice.md.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide explicitly asks for replies, comments, and DMs as source material, which can include private communications, third-party personal data, and sensitive business information. Because it provides no warning to share only content the user owns or has permission to use, the skill may normalize collecting and processing private material without consent or minimization safeguards.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guide encourages users to submit podcast clips, webinars, voice memos, Looms, and sales call transcripts, which may contain personal data, confidential business discussions, or recordings of other people. Without any consent, recording, retention, or redaction guidance, the skill increases the risk of unauthorized sharing of sensitive audio/transcript content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.