Maylo Voice Assistant

• Outcome: Review
• Latest audit: May 29, 2026 at 9:22 PM UTC
• Version:
  0.1.0

Overview

This is a real local voice assistant, but its network web UI can accept or trigger audio processing without authentication, so it needs careful review before use.

Install only if you are comfortable running a local voice assistant that listens through the Mac microphone, saves audio/log artifacts, and exposes a web UI on your network. Prefer binding the UI to localhost or a trusted interface, add authentication before using 0.0.0.0, disable MAYLO_WEB_WAKE unless you explicitly want web-started wake listening, and review the OpenClaw agent’s permissions because spoken or streamed audio becomes local agent input.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the user to run local shell scripts, copy application files, create a virtual environment, and start services, which clearly implies shell, file read/write, and environment access despite not declaring permissions. Undeclared capabilities undermine the platform’s trust and review model because operators may authorize or execute the skill without understanding that it can modify files and launch processes on the host.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The web server starts an always-on wake-word listener automatically at application startup, which expands the component from a UI service into a background audio-capture service without an explicit opt-in. In this context, that creates privacy and operational risk because merely launching the web UI can enable continuous microphone monitoring on the host Mac mini.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The /ws/audio endpoint accepts arbitrary audio streamed over WebSocket and processes it immediately, but there is no authentication, origin restriction, consent flow, or user-warning mechanism visible in this file. In a voice-assistant context this increases privacy risk and can allow any reachable client to submit microphone-derived audio for transcription/agent processing.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The legacy push-to-talk path can trigger server-side microphone processing via assistant.run_once_ptt(), and startup also enables background wake-word listening by default. That means remote interaction with the web UI can cause audio capture on the server host itself, which is more sensitive than ordinary client-side recording because it activates the machine's microphone.

VirusTotal

64/64 vendors flagged this skill as clean.