Audio Mastering CLI

• Analyzed: May 11, 2026, 4:34 AM
• Findings: 0
• Version: 1.0.2
• Hash: 4af7b5f43d9cc15ee0a96ce4e5e076122fdf293e71eb3231dfd557786db6ebd3
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: audio-mastering-cli Version: 1.0.2 The skill is designed for audio mastering using `ffmpeg` and PowerShell. It is classified as suspicious due to a critical shell injection vulnerability identified in the `SKILL.md` file. The instructions for the OpenClaw agent directly embed user-provided file paths (`<ruta-archivo>`) into `powershell` and `ffmpeg` commands without any explicit sanitization. This flaw could allow a malicious user to inject arbitrary commands, potentially leading to remote code execution if the OpenClaw agent does not robustly sanitize inputs before execution. There is no evidence of intentional malicious behavior such as data exfiltration, persistence, or obfuscation.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Concern

What this means

The skill may fail as packaged, or users may end up running a separately obtained PowerShell script whose behavior was not included in this review.

Why it was flagged

The skill’s main workflow depends on scripts/master_media.ps1, but the provided manifest contains only README.md and SKILL.md, so the referenced helper script is missing and cannot be reviewed.

Skill content

powershell -ExecutionPolicy Bypass -File "{baseDir}/scripts/master_media.ps1" -InputFile "<ruta-archivo>" -MakeMp3

Recommendation

Only install or run this skill if the referenced script is present from a trusted source and you can inspect it before use.

ASI05: Unexpected Code Execution

Note

What this means

Running local scripts can read and write files on the machine according to the script’s behavior.

Why it was flagged

The skill intentionally runs a local PowerShell script and bypasses PowerShell execution policy. Local command execution is expected for a CLI audio-processing skill, but users should notice it.

Skill content

powershell -ExecutionPolicy Bypass -File "{baseDir}/scripts/master_media.ps1"

Recommendation

Review the script contents before running, and prefer a packaged, versioned implementation over manually supplied scripts.