ClawHub
Back to skill

Security audit

Audio Transcribe

Security checks across malware telemetry and agentic risk

Overview

The skill is an audio transcription tool, but it can automatically install or upgrade Whisper from pip and download models despite being framed as offline/private.

Install only if you are comfortable with the skill modifying your Python environment and downloading external packages/models. Prefer preinstalling reviewed, pinned dependencies in a virtual environment and avoid using it in strict offline or highly sensitive environments unless the automatic pip install behavior is removed or gated by explicit consent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Attempt to install whisper via pip."""
    print("Installing whisper...")
    try:
        subprocess.run([sys.executable, '-m', 'pip', 'install', '-U', 'openai-whisper'], 
                      check=True, capture_output=True)
        return True
    except subprocess.CalledProcessError:
Confidence
97% confidence
Finding
subprocess.run([sys.executable, '-m', 'pip', 'install', '-U', 'openai-whisper'], check=True, capture_output=True)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill documentation instructs the agent to execute a local Python script, read arbitrary user-specified audio files, and produce output files, which implies shell, file-read, and file-write capabilities without any declared permission boundary. In an agent ecosystem, undeclared capabilities are dangerous because users and policy engines may not realize the skill can access local files and invoke subprocesses, increasing the risk of over-privileged or unexpected execution.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The documentation says the skill is 'completely offline' and privacy-safe, but later states that the first run downloads a model. This mismatch can mislead users into supplying sensitive audio under the false assumption that no network access will occur, which is a security-relevant trust and disclosure issue even if the download is only for model acquisition.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill advertises local/offline transcription, yet the code may fetch software from the internet at runtime if Whisper is missing. That discrepancy materially changes the trust boundary and can expose users to unexpected network access and package supply-chain compromise.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Runtime package installation is unnecessary for the narrow task of transcribing audio and gives the script a broader capability than users would reasonably expect. This increases attack surface because a compromised package, index, mirror, or dependency chain could execute untrusted code on the host.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The trigger phrases are broad and generic, such as common requests to transcribe audio or generate subtitles, without contextual boundaries or confirmation steps. In a multi-skill agent, this increases the chance of accidental activation on ordinary conversation, leading to unintended file access or shell execution against local audio paths.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The example '当用户说"转录这个音频"时，运行' provides ambiguous invocation guidance without defining how the referenced audio file is resolved or what safety checks occur before command execution. This can cause the agent to infer paths or act on the wrong file, making unintended local file processing and shell execution more likely.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
Automatically installing software without confirmation removes an important user control and can cause unanticipated network activity or code changes on the system. In a skill that claims local transcription, this behavior is especially risky because users may not expect any package management side effects.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.