mph-voice-refresh
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform local file system analysis of Claude chat transcripts stored in
~/.claude/projects/*/*.jsonl. These scripts operate within the user's home directory and read existing chat logs to extract linguistic patterns. - [EXTERNAL_DOWNLOADS]: The
mine_feed.pyscript fetches data from a Substack RSS feed (mphinance.substack.com/feed) using standard Python libraries. This is a legitimate function for the skill's stated purpose of gathering published writing examples. - [DATA_EXPOSURE]: While the skill accesses personal chat transcripts, the data is processed locally by the scripts and output to the terminal for user review. No data exfiltration to external servers was detected.
- [SAFE_PRACTICE]: The skill implements a 'human-in-the-loop' design, requiring the user to review and approve all candidates before modifying the
VOICE.mdfile. It specifically excludes sensitive project paths (e.g., SSH-based sessions) and does not perform automatic commits.
Audit Metadata