registry / @firstpick/pi-package-natural-conversation / 0.1.1

@firstpick/pi-package-natural-conversation@0.1.1

Safe per-process Natural Conversation Mode for Pi, with /talk commands and read-only tool constraints.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User invokes `/talk setup` and confirms choices, then enables audio.

Impact

Persists voice settings; optional user-local service; configured providers receive voice/audio data.

Mechanism

Consent-gated voice configuration, local process orchestration, and optional STT/TTS requests.

Rationale

Source shows an explicit-user-command Pi configuration mutation and optional persistence, not malicious installation or stealth behavior. Per policy, this warrants a warning rather than a block.

Evidence

package.jsonextensions/natural-conversation.tslib/setup-wizard.mjslib/stt-provisioner.mjslib/voice-config.mjslib/providers/select.mjs~/.pi/agent/voice.json~/.config/systemd/user/whisper-server.service

Network endpoints5

huggingface.co/ggerganov/whisper.cpp/resolve/mainhuggingface.co/rhasspy/piper-voices/resolve/main/v1/audio/speech

@firstpick/pi-package-natural-conversation@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code