Flatsonar

Almond

by Stanford Open Virtual Assistant Lab

The Open Virtual Assistant

Dangerous permissions Unverified publisher Apache-2.0 v2.0.0
Install Source code
Screenshot 1 of Almond Screenshot 2 of Almond Screenshot 3 of Almond Screenshot 4 of Almond Screenshot 5 of Almond

About

Almond is a virtual assistant that lets you interact with your services and accounts in natural language, with flexibility and privacy. Almond draws its power from the crowdsourced Thingpedia, an open collection of Web and Internet of Things APIs. Anyone can contribute support for the favorite service, with few lines of code and a handful of natural language sentences.

Permissions

7 permissions weaken the sandbox. Flatsonar asks before installing.

  • full access to your entire file system
    --filesystem=host
  • sandbox escape: can run commands on the host via flatpak-spawn
    --talk-name=org.freedesktop.Flatpak
  • X11 display: X11 lets apps read input and windows of other apps
    --socket=x11
  • dconf: all GNOME settings
    --talk-name=ca.desrt.dconf
  • talks to system service org.bluez
    --system-talk-name=org.bluez
  • GNOME Shell: screenshots, keybindings
    --talk-name=org.gnome.Shell
  • your keyring / saved passwords
    --talk-name=org.freedesktop.secrets
  • inter-process communication (needed for X11)
    --share=ipc
  • Wayland display
    --socket=wayland
  • audio
    --socket=pulseaudio
  • network
    --share=network
  • GPU acceleration
    --device=dri
  • talks to org.gtk.vfs.*
    --talk-name=org.gtk.vfs.*
  • session inhibit
    --talk-name=org.gnome.SessionManager
  • talks to org.gnome.Shell.Screenshot
    --talk-name=org.gnome.Shell.Screenshot
  • talks to org.gnome.ScreenSaver
    --talk-name=org.gnome.ScreenSaver
  • notifications
    --talk-name=org.freedesktop.Notifications

Who publishes this

Nobody has confirmed that the publisher controls this app id. Flatsonar warns before installing.

  • edu.stanford.Almond claims the domain stanford.edu; only its owner can prove that
    publisher:namespace
  • fetches from www.netlib.org over unencrypted http: anyone on the path can swap the bytes (x5)
    source:insecure-url
  • git source tracks a moving branch: what gets built can change without the manifest changing
    source:unpinned

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.