Voice messaging setup

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:22 AM UTC
• Version: 1.0.3

Overview

This skill coherently sets up voice transcription and voice replies for OpenClaw, with ordinary but real dependency and privacy considerations.

Before installing, consider whether voice messages and generated replies may contain sensitive content. Use this in environments where Edge TTS remote processing is acceptable, and prefer pinned Python dependencies or a reviewed lockfile if you need reproducible, higher-assurance installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15 and 55
Vulnerability Type: Supply-chain exposure through an unpinned Python dependency
Risk Level: Medium

Vulnerable Code

Installation metadata at line 15:

json

{
  "id": "faster-whisper-venv",
  "kind": "bash",
  "label": "Install faster-whisper in venv",
  "command": "python3 -m venv ~/.openclaw/workspace/voice-messages && ~/.openclaw/workspace/voice-messages/bin/pip install faster-whisper"
}

The installation instructions repeat the unsafe command at line 55:

bash

~/.openclaw/workspace/voice-messages/bin/pip install faster-whisper

Technical Analysis

The Skill installs faster-whisper without a fixed version, dependency lockfile, or package hashes. Pip therefore resolves the latest package and compatible transitive dependencies available from its configured package index at installation time.

This makes the executed dependency set mutable after the Skill has been reviewed. A compromised future release, compromised package-index account, or malicious transitive dependency could introduce attacker-controlled code. A virtual environment limits package isolation but does not sandbox execution or restrict access to resources available to the OpenClaw user.

Attack Path

1. An attacker compromises the faster-whisper distribution channel, a maintainer account, or one of its unresolved transitive dependencies.
2. The attacker publishes a malicious release that satisfies pip's unconstrained resolution.
3. A user installs the Skill or follows its installation instructions.
4. Pip downloads and installs the malicious package because no reviewed version or cryptographic hash is required.
5. Attacker-controlled code runs during package installation, Python import, model initialization, or subsequent audio transcription.
6. The malicious code operates with the permissions of the user running OpenClaw.

Impac

...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin faster-whisper to a specifically reviewed version rather than installing an unconstrained latest release.

2. Resolve and pin all transitive dependencies in a lockfile generated in a controlled environment.

3. Record cryptographic hashes for every package artifact and install with hash enforcement, for example:

   bash

   ~/.openclaw/workspace/voice-messages/bin/pip install \
     --require-hashes \
     -r requirements.lock
   

4. Prefer an explicitly trusted package index and disable unintended fallback indexes to reduce dependency-confusion exposure.

5. Review dependency updates and regenerate the lockfile intentionally rather than resolving new releases during every installation.

6. Run transcription with least privilege and restrict the OpenClaw service account's access to credentials, configuration files, and unrelated user data.

7. Apply the same secured installation command in both the executable metadata and the documentation so users cannot inadvertently follow the unsafe variant.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

{
            "id": "transcribe-script",
            "kind": "bash",
            "label": "Create transcribe.py script",
            "command": "cat > ~/.openclaw/workspace/voice-messages/transcribe.py << 'EOF'\n#!/usr/bin/env python3\nimport argparse\nfrom faster_whisper import WhisperModel\n\ndef transcribe(audio_path: str, model_name: str = \"small\", lang: str = \"en\", device: str = \"cpu\") -> str:\n    model = WhisperModel(\n        model_name,\n        device=device,\n        compute_type=\"int8\" if device == \"cpu\" else \"float16\",\n    )\n    segments, _ = model.transcribe(audio_path, language=lang, vad_filter=True)\n    text = \" \".join(seg.text.strip() for seg in segments if seg.text and seg.text.strip()).strip()\n    return text\n\ndef main():\n    p = argparse.ArgumentParser()\n    p.add_argument(\"--audio\", required=True)\n    p.add_argument(\"--model\", default=\"small\")\n    p.add_argument(\"--lang\", default=\"en\")\n    p.add_argument(\"--device\", default=\"cpu\", choices=[\"cpu\", \"cuda\"])\n    args = p.parse_args()\n    text = transcribe(args.audio, args.model, args.lang, args.device)\n    print(text if text else \"\")\nif __name__ == \"__main__\":\n    main()\nEOF"
          }
        ]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill configures Edge TTS for voice replies but does not clearly warn users that reply text may be sent to an external provider for synthesis. In a voice workflow, transcribed content can contain sensitive personal data, so undisclosed remote processing creates a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The transcription script documentation fixes --lang to en, and the TTS configuration also fixes lang to en-US and an English voice. This is a language/locale policy issue because the skill defaults to a specific language behavior without presenting it as a user-selectable option or documenting why English-only operation is required.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The skill recommends running npx clawhub without pinning a specific package version, which allows whatever version is currently published to be fetched and executed. If the upstream package is compromised, updated maliciously, or unexpectedly changed, users may execute unreviewed code during installation or use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.