skills/vesely/skills/handsfree/Gen Agent Trust Hub

handsfree

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches a speech recognition model (ggml-tiny.en.bin) from Hugging Face to enable local voice trigger detection. This is a trusted external service and the download is required for the core functionality.
  • [COMMAND_EXECUTION]: Utilizes AppleScript (osascript) to simulate keyboard input (specifically the 'Return' key code 36) and activate application windows. This automation is necessary for the 'hands-free' submission process and requires standard macOS Accessibility permissions.
  • [COMMAND_EXECUTION]: Executes background processes using nohup to run a continuous audio listener that monitors the microphone for the specific trigger word 'appendix'.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: Accesses the local Wispr Flow SQLite database (flow.sqlite) to insert or update voice snippets. The script performs these actions locally, includes a database backup mechanism, and checks for running processes to prevent file corruption.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 09:40 PM
Security Audit — agent-trust-hub — handsfree