voice-agent

Skill code uses network libraries but doesn't declare network requirement

The start.sh script automatically pulls the latest Docker image (trevisanricardo/ai-voice-backend) without version pinning. This creates a supply chain risk where a compromised or malicious image update could be automatically downloaded and executed on the user's system. The script uses 'docker pull $IMAGE_NAME || true' which silently fails if the pull encounters issues, potentially running outdated or cached images.

scripts/start.sh

echo "☁️ checking for image updates..."
docker pull $IMAGE_NAME || true

The start.sh script attempts to mount ~/.aws credentials into the Docker container. While the actual mount command is truncated, this pattern indicates the skill may be providing AWS credentials to an external Docker container. If the container or image is compromised, these credentials could be exfiltrated. The comment 'Assuming .env and ~/.aws exist' suggests environment variables and AWS credentials are being shared with the container.

scripts/start.sh

# Assuming .env and ~/.aws exist in the current directory context or user home
# We need to resolve absolute paths for volumes usually, but ~ works in shell expansion.

The transcribe function accepts arbitrary file paths from user input without validation or sandboxing. While the skill is designed to transcribe audio files, there's no verification that the file is actually an audio file or that it's within an expected directory. A malicious user could potentially point the skill to sensitive files, which would then be uploaded to the localhost API (and potentially logged or processed in unexpected ways).

scripts/client.py

def transcribe(filename):
    if not os.path.exists(filename):
        print(f"❌ File not found: {filename}")
        return
    try:
        print(f"📤 Transcribing {filename}...")