voice-mode
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via the Python
subprocessmodule to handle speech playback and interaction with the AI model. - Uses
afplay(a standard macOS utility) to play temporary MP3 files generated by the TTS service. - Invokes the
claudeorcodexCLI tools to process the conversation logic in theask_brainfunction. - [EXTERNAL_DOWNLOADS]: Performs network operations to interact with ElevenLabs API endpoints for speech processing.
- Sends audio data to
https://api.elevenlabs.io/v1/speech-to-textfor transcription. - Sends text data to
https://api.elevenlabs.io/v1/text-to-speechfor synthesis. - [PROMPT_INJECTION]: Transcribed user speech is directly interpolated into the prompt sent to the AI engine without sanitization or protective boundary markers.
- Ingestion points: Audio captured from the microphone is transcribed into text in
voice_mode.py. - Boundary markers: Absent; user transcript is concatenated directly with system instructions in the
ask_brainfunction. - Capability inventory: The resulting prompt is passed to
subprocess.runto be executed by theclaudeCLI. - Sanitization: Absent; the transcribed text is used as-is, allowing spoken instructions to potentially override the
VOICE_SYSTEM_PROMPT. - [CREDENTIALS_UNSAFE]: The skill accesses sensitive API keys by reading configuration files from the local file system.
- It specifically targets
~/.claude/skills/eleven-labs-skill/config.jsonto reuse an ElevenLabs API key, which is a form of cross-skill credential access.
Audit Metadata