handsfree
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a speech recognition model (
ggml-tiny.en.bin) from Hugging Face to enable local voice trigger detection. This is a trusted external service and the download is required for the core functionality. - [COMMAND_EXECUTION]: Utilizes AppleScript (
osascript) to simulate keyboard input (specifically the 'Return' key code 36) and activate application windows. This automation is necessary for the 'hands-free' submission process and requires standard macOS Accessibility permissions. - [COMMAND_EXECUTION]: Executes background processes using
nohupto run a continuous audio listener that monitors the microphone for the specific trigger word 'appendix'. - [DATA_EXPOSURE_AND_EXFILTRATION]: Accesses the local Wispr Flow SQLite database (
flow.sqlite) to insert or update voice snippets. The script performs these actions locally, includes a database backup mechanism, and checks for running processes to prevent file corruption.
Audit Metadata