Security audit

voice-setup

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a disclosed writing-voice tool, but it needs Review because its optional Claude Code install adds persistent hooks that inspect prose writes and can rewrite Git commit or GitHub PR command text.

Install only if you want rabbit-writes to persist inside Claude Code. Run --status and --install --dry-run first, inspect the exact files and hook commands, prefer project scope when possible, and avoid --apply-model on sensitive documents unless you control and trust the configured endpoint.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises no explicit permissions, yet the documentation clearly describes capabilities involving shell execution, file reads/writes, environment-variable access, and optional network use. That mismatch is dangerous because it prevents hosts or users from making an informed trust decision and can lead to over-privileged execution of a skill that modifies local files and invokes external endpoints.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior goes well beyond voice-profile setup into scanning arbitrary documents, rewriting content, contacting OpenAI-compatible endpoints, and installing persistent Claude Code hooks/styles. This scope expansion is risky because users may invoke a seemingly narrow skill without realizing it can alter host configuration, process unrelated content, and send data to remote services.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill includes a host installer that writes into user or project Claude configuration, which exceeds the core voice-profile authoring task and creates persistent changes outside the skill directory. Even though the text says to ask first and use dry-run, embedding this capability in the same skill increases the chance of unintended configuration drift or social-engineering-assisted persistence.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is presented as rabbit-writes voice setup, but the documentation also instructs host-level installation and persistent output-style enforcement for Claude Code. This mismatch makes the persistence behavior less expected in context, which increases the security risk because users may consent to profile setup without appreciating that session-wide behavior will be modified.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The hook modifies `git commit` and `gh pr create` message bodies even though the skill is described as voice-profile setup/switching. That is a scope-expanding behavior affecting version-control metadata, which can silently alter audit trails, attribution, or user-authored intent in commits and PRs without the skill manifest clearly disclosing that capability.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The hook performs automatic scanning and enforcement-style reporting on edited prose files, which is not described by the manifest's voice-setup purpose. Hidden monitoring/enforcement behavior is dangerous because it changes the trust model of the skill: users invoking a setup tool would not reasonably expect all matching file writes to be inspected and fed back into model context.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This code intercepts Bash commands and rewrites `git commit` and `gh pr create` inputs before execution, giving the skill the ability to alter version-control history and GitHub submissions. In the context of a voice-setup skill, that capability is overprivileged and unexpected; if abused or if the rewriting logic is wrong, it could silently remove content, modify approvals/explanations, or tamper with provenance and repository workflows.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The `profile_allowances` function imports `engine_exemptions` from a voice profile and turns them into active scan suppressions. That creates a trust boundary violation: user-controlled or profile-controlled voice configuration can disable unrelated security checks, which is especially risky because voice setup should not grant policy-exemption capability. In an agent skill, an attacker who can influence the profile could persistently suppress findings across future scans.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file implements broad document scanning, reporting, and model-backed rewriting, which materially exceeds the declared 'voice-setup' purpose. In an agent-skill setting, capability mismatch is dangerous because it can cause users or orchestrators to grant the skill access to arbitrary documents and rewriting behavior they did not expect, including sending content to model infrastructure and modifying files.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The code can rewrite user documents and write changes back in place via --write, which is a destructive capability outside the stated voice-profile setup/switching purpose. In a skill ecosystem, undisclosed file mutation is security-relevant because it expands the trust boundary from configuration management into content modification, creating risk of data loss, unauthorized edits, or abuse through prompt-driven file changes.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill can send passages from user documents to an OpenAI-compatible endpoint, which is a network exfiltration capability not justified by the advertised voice-setup role. Even though it sends passages rather than whole documents, that still exposes potentially sensitive content to external services and can violate user expectations, privacy requirements, or data-handling policy.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The profile instructs the system to use gendered formal salutations like 'Sir' and 'Ma'am' by default for certain audiences without confirming the recipient's preference or identity. In practice, this can cause misgendering, inappropriate honorific use, or socially harmful outputs, especially in professional or sensitive communication, making the skill more dangerous because it is specifically designed to generate user-facing text.

Session Persistence

Medium

Category: Rogue Agent
Content: ### `install_host.py` `python3 {baseDir}/scripts/install_host.py --status|--install|--uninstall [options]` - `--status`: (REQUIRED choice) Report what is installed, where, and whether any installed file has been edited by hand since. - `--install`: (REQUIRED choice) Write the output styles, add the hooks, and record what was written. - `--uninstall`: (REQUIRED choice) Remove exactly what `--install` wrote, restoring the previous `outputStyle`. - `--scope`: (OPTIONAL, choice: `user`, `project`, default: `user`) `user` writes `~/.claude`, `project` writes `.claude` in the working directory. - `--dry-run`: (OPTIONAL, boolean flag) Print every write and touch nothing. Show this to the user before running `--install`.
Confidence: 91% confidence
Finding: The documented install flow writes output styles, adds hooks, and persists changes across sessions by modifying user or project Claude configuration. Session persistence is security-relevant because it can continue influencing future interactions and automated events after the original task is complete, especially if hooks intercept commit or PR message workflows.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/rwlib/voices.py:688

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/rwlib/endpoint.py:54