other
Note
- Location
install.sh:19- Finding
Undisclosed Installation Telemetry
- Content
View full analysis
- Remediation
View remediation
Security audit
Transcription
Security checks for vulnerabilities and agentic risk
Overview
This transcription skill is incomplete and makes undisclosed install-time changes and telemetry calls that users should review before installing.
Review this skill carefully before installing. It may be intended for transcription, but this package does not include the actual transcribe executable, makes a persistent change to your zsh startup file, and sends an install analytics request to Signal Loom. Do not rely on the local-only privacy claim until the publisher supplies the missing executable and clearly documents whether audio, video, or metadata are uploaded.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
install.sh:16- Finding
Persistent and Unmanaged Shell Configuration Modification
- Content
View full analysis
/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" ``` ### Technical Analysis The installer silently and persistently modifies the user's `.zshrc` file. The new configuration prepends `~/.local/bin` to `PATH`, causing executables in that user-controlled directory to take precedence over commands in subsequent PATH entries. The package does not request consent, create a backup, delimit the managed configuration with identifiable markers, or provide an uninstall procedure. Its detection logic only searches for the literal substring `~/.local/bin`, so semantically equivalent PATH entries may not be recognized and unrelated comments containing that substring may produce false positives. Prepending a writable directory is not by itself arbitrary code execution. Exploitation additionally requires an attacker or another compromised process to place a malicious executable with the same name as a command the user later invokes. The modification nevertheless expands the effect of such executable planting across future shell sessions. ### Attack Path 1. The user runs `install.sh`. 2. The installer appends an export statement to `~/.zshrc`. 3. A future Zsh session loads the modified configuration and places `~/.local/bin` before existing PATH directories. 4. An attacker with the ability to write into the user's local binary directory places an executable whose name matches a commonly invoked command. 5. When the user invokes that command without an absolute path, the shell resolves the planted executable first. 6. The planted executable runs with the affected user's privileges. ### Impact Assessment The direct impact is a persistent change to the user's future interactive Zsh sessions. No root ...[truncated 410 chars]- Remediation
View remediation
other
Warning
- Location
package.json:4- Finding
Missing Declared Executable and Contradictory Privacy Claims
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A description-behavior mismatch is dangerous because users may trust privacy and local-processing claims while the actual implementation performs unrelated install-time actions such as shell profile modification and outbound telemetry. That combination can conceal unexpected persistence, environment tampering, or data disclosure under the cover of a benign transcription feature.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 79% confidence
- Finding
The skill advertises executable capability via a required binary but declares no explicit tool scope or permissions boundary. In agent environments, undeclared shell-capable behavior weakens reviewability and can let a seemingly simple content skill invoke local commands without clear user or platform constraints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill claims local privacy benefits while also referencing use of a vendor API, but it does not warn users that media or metadata may leave the device depending on how the API is used. For transcription workflows, audio and video frequently contain sensitive personal or business information, so omission of off-device transfer risk can lead to unintended data exposure.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh LOCAL_BIN="${HOME}/.local/bin" echo "Installing ${SKILL_NAME}..." mkdir -p "$OPENCLAW_SKILLS" "$LOCAL_BIN" # Symlink into OpenClaw skills dir ln -sf "$SCRIPT_DIR" "$OPENCLAW_SKILLS/${SKILL_NAME}"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Appending to ~/.zshrc without notice or confirmation is an unsafe installation practice because it creates persistent environmental changes outside the core transcription function. Silent profile modification reduces user control and can be abused in other contexts to establish persistence or influence future command execution.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installer silently sends a network telemetry event to a remote endpoint during installation, which contradicts the privacy-oriented framing of the skill and creates an undisclosed data flow. Even though the payload shown is limited to skill/version/source, silent outbound communication during install erodes trust and can expose metadata such as IP address and install timing to the vendor.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The installer performs an undisclosed analytics POST in the background, so users may never notice that installation triggers a remote call. This is dangerous from a privacy and supply-chain trust perspective because installers should minimize hidden side effects, especially network egress unrelated to the core install action.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The hardcoded remote API endpoint indicates install-time communication with a vendor-controlled service. In context, this is not remote code execution, but it is still a real privacy and transparency issue because the installer reaches out to the network for analytics rather than essential operation.
- Content
sh grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" # Fire install ping (no auth — tracks community installs) curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \ -H "Content-Type: application/json" \ -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The hardcoded remote API endpoint indicates install-time communication with a vendor-controlled service. In context, this is not remote code execution, but it is still a real privacy and transparency issue because the installer reaches out to the network for analytics rather than essential operation.
- Content
sh grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" # Fire install ping (no auth — tracks community installs) curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \ -H "Content-Type: application/json" \ -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The installer modifies the user's shell startup file to prepend ~/.local/bin to PATH without warning or confirmation. While commonly done for convenience, persistent shell configuration changes are security-sensitive because they alter command resolution for future sessions and may have unintended side effects.
- Content
Static analysis
No suspicious patterns detected.