ClawHub
Back to skill

Security audit

Audio Transcribe

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it locally transcribes audio with faster-whisper, with privacy and supply-chain caveats users should understand before enabling it.

Install this only where automatic transcription of voice messages is acceptable to the people using the bot. Prefer a virtual environment, pin faster-whisper and its dependencies, avoid running pip as root, and document who can trigger transcription and how transcripts are stored or deleted.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:6-10
Additional Location: scripts/transcribe.py:11-16
Vulnerability Type: Unpinned dependency and unverified supply-chain artifacts
Risk Level: Medium

Vulnerable Code

From SKILL.md:

bash
## Requirements

```bash
pip install faster-whisper
text

The script repeats this installation instruction:

```python
try:
    from faster_whisper import WhisperModel
except ImportError:
    print("Error: faster-whisper not installed")
    print("Run: pip install faster-whisper")
    sys.exit(1)

Technical Analysis

The project directs users to install faster-whisper without specifying an audited version, locking transitive dependencies, or verifying package hashes. Consequently, installation resolves whatever package version and dependency graph the configured Python package index provides at that time.

Python package installation may execute package build or installation logic. If the package source, a release, a transitive dependency, the configured index, or the dependency-resolution process is compromised, attacker-controlled code could execute during installation or later when faster_whisper is imported.

In addition, WhisperModel(MODEL_SIZE, ...) automatically retrieves model artifacts on first use, as documented by the project. The project does not pin a model revision or document integrity verification. This expands the external supply-chain surface, although the reviewed code contains no evidence that the model retrieval is intentionally malicious.

Attack Path

  1. An attacker compromises a relevant package release, transitive dependency, package repository, or the user's package-index configuration.
  2. A user follows the documented pip install faster-whisper command.
  3. Because no version or hashes are enforced, the resolver downloads the attacker-influenced artifact.
  4. Malicious package logic executes ...[truncated 824 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin faster-whisper to a specifically reviewed version rather than installing the latest available release:
    bash
    python3 -m pip install faster-whisper==<reviewed-version>
  2. Generate and commit a lock file that fixes all transitive dependency versions.
  3. Require cryptographic hashes during installation, for example through a hash-locked requirements file and pip install --require-hashes.
  4. Explicitly use a trusted package index and prevent unintended fallback to untrusted or private indexes.
  5. Install dependencies inside an isolated virtual environment under an unprivileged account; do not run pip as root.
  6. Pin trusted model identifiers and revisions where supported, and verify downloaded model artifacts using vendor-provided checksums or signatures.
  7. Add automated dependency vulnerability and provenance scanning to the release process.
  8. Update both SKILL.md and the error message in scripts/transcribe.py so users receive the same hardened installation command.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
- `SKILL.md` — This file

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states that Clawdbot auto-transcribes incoming voice messages when enabled, but it does not describe any scope limits, consent requirements, or conditions under which transcription occurs. This can lead to over-collection of sensitive audio content and surprise processing of user data, creating privacy and compliance risks even if transcription is local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation does not provide a user-facing warning that voice messages will be automatically processed and converted to text. Users may share sensitive spoken information without realizing it will be transcribed, which increases privacy exposure and can create legal or policy issues around notice and consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The module documentation states 'Local transcription, no API key needed', which implies entirely local operation. However, the code comment at L31 and model initialization at L32 indicate the model may be downloaded on first run, introducing external network behavior not reflected in that description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.