Settings

What the source does

• FilesystemUndeclared2 observations, not in its own description
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

import type { ToolContext } from "../../../../tools/types.js";

import { throwIfCancelled } from "../../../../tools/shared/abort.js";

} from "../../../../tools/types.js";

import type { ToolContext } from "../../../../tools/types.js";

mock.module("../../../../util/platform.js", () => ({

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/assistant/src/config/bundled-skills/settingsThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Manage assistant voice and system settings

---
name: settings
description: Manage assistant voice and system settings
compatibility: "Designed for Vellum personal assistants"
metadata:
  emoji: "\u2699\uFE0F"
  vellum:
    display-name: "Settings"
    category: "system"
    activation-hints:
      - "User wants to change the assistant's voice, TTS provider, or speech output"
      - "User wants to rebind the push-to-talk key or adjust microphone / conversation timeout"
      - "User wants to open the in-app settings tab or navigate to a specific preference"
---

Tools for managing assistant settings: voice configuration (TTS voice, PTT activation key, conversation timeout), system settings navigation, and in-app settings tab navigation.

Excerpt, first 703 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Settings

• github.com/vellum-ai/vellum-assistant/tree/main/assistant/src/co — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology