ClawHub

Alicloud Ai Audio Asr

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Alibaba Cloud speech-to-text skill, but users should understand that selected audio is sent to DashScope and transcripts are saved locally.

Install only if you are authorized to send the chosen audio to Alibaba Cloud DashScope. Use a scoped API key, avoid processing highly sensitive recordings unless your compliance requirements allow it, and protect or delete saved transcript and raw-response files when they contain private content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill exercises sensitive capabilities—environment variable access, file read/write, and outbound network calls—but does not declare permissions or present that capability surface explicitly. This increases the chance that agents or users invoke it without understanding it will read credentials, upload audio to a third-party service, and persist outputs locally.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation instructs users to send audio content and bearer-authenticated requests to external ASR endpoints, but it does not warn that uploaded audio may contain sensitive personal, business, or regulated data. In a transcription skill, the context makes this more significant because the primary function is to transmit potentially sensitive voice data off-box to a cloud provider.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal