v1.0.1

TL;DX

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 8:01 AM.

Analysis

TL;DX has a clear transcription and summarization purpose, but its helper scripts can install system packages with sudo and fetch/build unpinned external components, so users should review it before installing.

GuidanceInstall only if you are comfortable with local media-processing tools being provisioned. Prefer preinstalling ffmpeg yourself, review or pin the whisper.cpp source/model downloads, and be cautious about granting sudo access or allowing persistent memory to influence outputs.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

scripts/ensure_whisper_cpp.sh

git clone --depth=1 https://github.com/ggml-org/whisper.cpp.git "${REPO_DIR}" ... cmake --build "${REPO_DIR}/build" --config Release --target whisper-cli

The script clones and builds the current upstream whisper.cpp source without a pinned commit, release, or checksum before using the resulting executable.

User impactThe code the user runs can change over time depending on the upstream repository state, which increases supply-chain risk.

RecommendationPin a known-good release or commit, verify checksums/signatures where possible, and disclose the exact build source in install metadata.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

scripts/ensure_whisper_model.sh

curl -L --fail --continue-at - "${url}" -o "${partial}" ... if [[ "${size_bytes}" -gt 100000000 ]]; then
        mv "${partial}" "${output}"

The Whisper model download is purpose-aligned, but integrity validation appears limited to a size threshold rather than a pinned hash or signature.

User impactUsers may download a large remote model file whose exact contents are not independently verified by the script.

RecommendationPublish expected hashes for supported models and verify them after download.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

scripts/run_whisper_cpp.sh

WHISPER_BIN="$("${SCRIPT_DIR}/ensure_whisper_cpp.sh")" ... "${WHISPER_BIN}" \
  -m "${MODEL_PATH}" \
  -f "${AUDIO_INPUT}"

The skill executes local transcription binaries as part of its core media workflow; this is expected for the stated purpose but should be visible to users.

User impactTranscribing media can run local executables, consume CPU/disk, and process local media files.

RecommendationRun the skill only on media you intend to process locally, and review the runtime setup before first use.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusConcern

scripts/ensure_ffmpeg.sh

if command -v sudo >/dev/null 2>&1; then
    sudo "$@"
...
retry_command 3 run_with_optional_sudo apt-get install -y ffmpeg || true

The helper can invoke system package managers through sudo to install ffmpeg during runtime provisioning, granting OS-level installation authority that is not declared in the requirements.

User impactThe agent may prompt for administrator access or alter system packages when preparing to transcribe media.

RecommendationRequire explicit user approval before any sudo or package-manager step, or ask users to install ffmpeg themselves and declare that requirement clearly.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceMediumStatusNote

SKILL.md

If the environment provides a stable memory file and the workflow permits reading it, use it carefully.

The skill may use persistent memory for personalization, which is purpose-aligned but can influence outputs based on prior stored context.

User impactPrior preferences or notes could shape the summary or analysis if a memory file is available.

RecommendationUse memory only when the user expects personalization, and allow users to opt out or review what memory is being used.