openclaw-whisper-asr

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:04 AM UTC
• Version: 1.0.0

Overview

This is a coherent local speech-to-text setup, but it asks users to install and run mutable external code without version or integrity checks.

Review before installing. Prefer pinning whisper.cpp to a known commit or release, verify model checksums where possible, avoid running downloaded scripts as root, and delete temporary audio files after transcription, especially for sensitive voice messages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned Remote Dependency Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-61
Vulnerability Type: Unverified and unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

cd /home/brew/.openclaw/workspace
git clone https://github.com/ggml-org/whisper.cpp.git

bash

cd whisper.cpp
sh ./models/download-ggml-model.sh base

bash

cd whisper.cpp
cmake -B build
cmake --build build -j --config Release

Technical Analysis

The installation instructions clone the current default branch of an external Git repository without pinning a reviewed commit hash or authenticated release. They subsequently execute a shell script from that repository and compile its source code.

Because the repository reference is mutable, the effective code executed during installation can change after the Skill has been reviewed. No commit verification, release-signature validation, or cryptographic checksum validation is required for either the source repository or the model downloaded by download-ggml-model.sh.

This creates a supply-chain risk: compromise of the upstream repository, its maintainers, or the model distribution infrastructure could introduce arbitrary commands into the downloaded script or build process.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or infrastructure used by the model-download script.
2. The attacker modifies the default branch, download script, source tree, or fetched model artifact.
3. A user follows the Skill instructions and clones the latest mutable repository state.
4. The user runs download-ggml-model.sh and the CMake build process without verifying the retrieved content.
5. Attacker-controlled commands execute with the privileges of the user performing the installation.
6. If the installation is performed by a privileged account, the resulting impact extends to files and resources available to that account.

...[truncated 639 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin whisper.cpp to a specific reviewed commit hash or signed release rather than cloning and using the mutable default branch.
2. Verify the selected commit or release using an authenticated Git signature or trusted release signature.
3. Publish expected SHA-256 checksums for source archives and model files, and require verification before scripts, binaries, or models are used.
4. Review the model-download script before execution or replace it with an explicit download command targeting a versioned artifact with a fixed checksum.
5. Build and run the dependency as a dedicated unprivileged user in an isolated directory or container with minimal filesystem and network access.
6. Avoid running repository-provided scripts or build steps with sudo or as root.
7. Document a controlled upgrade process in which new commits and model artifacts are reviewed and their pinned hashes are updated intentionally.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description says it will automatically convert voice messages from multiple channels, but it does not define clear trigger boundaries or scoping rules. In an agent system, overly broad automation can cause the skill to activate on unintended message flows, resulting in unexpected processing of user content and privacy-sensitive audio data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill processes voice messages and the examples write converted audio to /tmp/audio.wav, but the documentation does not warn users that audio content may be stored on disk during processing. This creates a privacy and data-handling risk because sensitive voice data may persist in temporary files, be exposed to other local users, or be retained longer than expected.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

1. 安装 ffmpeg

bash

sudo apt-get update
sudo apt-get install -y ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

1. 安装 ffmpeg

bash

sudo apt-get update
sudo apt-get install -y ffmpeg

Static analysis

No suspicious patterns detected.