ClawHub
Back to skill

Security audit

Speech To Text With Speakers

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent remote transcription integration, with disclosed audio upload, task polling, billing, and transcript artifact storage behavior.

Install only if you are comfortable sending the selected audio to AgentPMT and its transcription providers. Avoid submitting recordings with confidential, regulated, or third-party content unless you have authorization and understand how resulting File Manager artifacts and signed URLs will be handled.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill instructs users to send audio via file_id or public_url to a remote transcription service but does not prominently warn that recordings may contain sensitive personal, legal, medical, or business information that will leave the local environment. In this context, the omission can cause unintentional disclosure of confidential audio content to third-party infrastructure and downstream processors.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The schema allows callers to supply a public URL for audio retrieval and states that completed transcripts are stored as File Manager artifacts, but it does not clearly warn users about these data-handling behaviors at the action interface. This can lead to unintended transmission of sensitive audio to remote infrastructure and retention of derived transcripts/artifacts that may contain confidential information.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.