registry / pi-voice-stt / 0.4.0

pi-voice-stt@0.4.0

Provider-agnostic speech-to-text dictation extension for the Pi TUI.

AI Security Review

scanned 20h ago · by lpm-firewall-ai

An explicit macOS installer creates persistent microphone-bridge and SSH-tunnel services. No install-time execution or unconsented activation was found.

Static reason

No blocking static signals were detected.

Trigger

User manually runs tools/install-macos-bridge.sh with a VPS SSH alias.

Impact

A configured VPS can access microphone recordings through the tunnel while the user-installed services run.

Mechanism

Persistent local audio bridge with reverse SSH forwarding.

Rationale

This is not malicious: activation is explicit and the observed audio/network behavior matches the stated speech-to-text bridge purpose. Its persistent reverse-tunnel capability is sufficiently sensitive to warn.

Evidence

package.jsonsrc/index.tssrc/providers/multipart.tstools/install-macos-bridge.shtools/macos-bridge-server.mjssrc/audio/bridge-recorder.ts

Network endpoints1

127.0.0.1:18765

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

pi-voice-stt@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code