ops-voice

SUSPICIOUS. The main voice features align with the stated purpose and use official API domains, but the `setup` routine is overbroad: it auto-enumerates multiple credential stores, reads Keychain secrets directly, and validates recovered keys in background network calls. This is not confirmed malware, but it exceeds a minimal voice-helper footprint and creates significant credential-handling risk.