Security audit

xeon_asr

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its local TTS purpose, but it exposes unauthenticated network services with filesystem-path access and installs persistent background services.

Review before installing, especially on shared or network-accessible machines. Only proceed if you are comfortable with package installation, model downloads, OpenClaw config edits, user-level autostart services, and local voice-file storage. Bind port 9002 to localhost or firewall it, add authentication, and avoid the direct clone-speak path API until it is restricted to server-managed reference audio IDs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The installer invokes a systemd service installation step without any interactive confirmation, dry-run, or clear disclosure of the system-level effects. This can modify persistence and startup behavior on the host unexpectedly, which is risky for a skill installer because users may not realize they are granting long-lived service execution.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script automatically starts local services immediately after installation unless the user knows to pass --skip-start. Automatically launching services can expose network listeners, background processes, or resource usage without the user's informed consent, especially in an installer context where startup behavior should be explicit.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script creates persistent user-level systemd unit files and immediately enables and starts them without any confirmation, dry-run, or explicit warning to the user. While this appears intended as convenience rather than abuse, silently establishing autostart behavior is security-relevant because it changes the user's persistence model and could keep network-exposed or buggy services running continuously.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The direct TTS endpoints write generated audio and, for clone mode, consume reference audio paths on disk, but these API responses do not provide the same retention/disclosure messaging present in the workflow endpoints. Because voice samples and synthesized speech are biometric/sensitive content, silent persistence increases privacy risk, especially if operators or other local processes can access retained files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.install_untrusted_source, suspicious.potential_exfiltration

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: self_check.sh:41

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: .clawhub.json:13

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.example.json:3

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: server.js:149