ClawHub
Back to skill

Security audit

Audio Transcription

Security checks for vulnerabilities and agentic risk

Overview

This audio transcription skill is coherent and purpose-aligned, but users should understand that it can send audio to OpenAI when local transcription tools are unavailable and an API key is configured.

Install this only if you are comfortable running local transcription tooling and, when OPENAI_API_KEY is set, potentially uploading the chosen audio file to OpenAI for transcription. Prefer local Whisper or whisper.cpp for private recordings, use an isolated environment for dependency installation, and pin reviewed dependency versions if deploying in a sensitive environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-56
Vulnerability Type: Unpinned third-party package and source-code installation
Risk Level: Medium

Vulnerable Code

bash
pip install openai-whisper
bash
git clone https://github.com/ggerganov/whisper.cpp.git ~/whisper.cpp
cd ~/whisper.cpp
make

Technical Analysis

The installation instructions retrieve mutable third-party content without pinning a package version, Git commit, release artifact, or cryptographic checksum.

pip install openai-whisper resolves whichever package version the configured Python package index currently serves and may execute package-controlled installation logic. Similarly, cloning the default branch of whisper.cpp and running make builds mutable upstream source code. The instructions do not verify package hashes, signed releases, repository commits, or build artifacts.

This creates a supply-chain trust boundary in which changes to the package registry entry, upstream repository, dependency resolution process, or associated maintainer accounts can alter the code users install after the Skill has been audited.

Attack Path

  1. An attacker compromises an upstream maintainer account, package publication process, repository, or another relevant supply-chain component.
  2. The attacker publishes a malicious package release or commits malicious source/build logic to the mutable upstream version selected by the documented commands.
  3. A user follows the Skill's dependency installation instructions.
  4. pip executes package installation behavior, or make executes attacker-controlled build commands.
  5. The malicious code runs with the privileges and environment of the user performing the installation.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the installing user's account. The resulting access may include reading or modifying files available ...[truncated 432 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin openai-whisper to a specifically reviewed version rather than installing the latest available release.
  • Use a requirements file with cryptographic hashes and install with hash verification, for example through pip install --require-hashes.
  • Pin whisper.cpp to an exact audited commit or signed release tag instead of cloning and building the mutable default branch.
  • Verify downloaded release artifacts or repository commits using trusted signatures or documented SHA-256 checksums.
  • Install Python dependencies inside an isolated virtual environment or container with minimal filesystem and credential access.
  • Perform builds as an unprivileged user and avoid sudo or root-level package installation.
  • Document the reviewed versions, expected hashes, update procedure, and source provenance so dependency updates trigger a new security review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents shell-based execution (scripts/transcribe.sh, pip install, git clone, make) but declares no explicit tool scope or permission boundaries. This can lead to over-broad shell access being assumed by the agent/runtime, increasing the chance of unintended command execution or installation steps without clear user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states it may use the OpenAI API for transcription but does not clearly warn that user audio may be transmitted to an external service. Audio often contains sensitive personal or business information, so silent fallback to a remote API creates a privacy and data-handling risk if users expect local-only processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code performs external transmission of the audio file to OpenAI's API, which is security-relevant because the payload can contain sensitive spoken content. In this skill's context, external transmission may be functionally legitimate, but it becomes dangerous because it happens without an explicit trust boundary warning or opt-in, increasing privacy and data-governance risk.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 98)May include surrounding context.

sh
fi
    
    if [[ "$LANGUAGE" == "auto" ]]; then
        curl -s -X POST https://api.openai.com/v1/audio/transcriptions \
            -H "Authorization: Bearer $OPENAI_API_KEY" \
            -H "Content-Type: multipart/form-data" \
            -F file=@"$AUDIO_CONV" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script uploads the user's audio file to OpenAI's external API when a local transcription backend is unavailable, but it does not provide any explicit warning, consent prompt, or policy notice before transmitting potentially sensitive voice data off-device. In the context of an audio-transcription skill, recordings may contain personal, confidential, or regulated information, so silent fallback to a third-party service creates a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This is a second code path that sends the audio file to the same external OpenAI endpoint, with the only difference being inclusion of the language parameter. As with the other path, the security issue is not the use of HTTPS itself but the undisclosed transfer of potentially sensitive audio to a third party.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 105)May include surrounding context.

sh
-F "model=whisper-1" \
            -F "response_format=text"
    else
        curl -s -X POST https://api.openai.com/v1/audio/transcriptions \
            -H "Authorization: Bearer $OPENAI_API_KEY" \
            -H "Content-Type: multipart/form-data" \
            -F file=@"$AUDIO_CONV" \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest description and usage guidance are presented in Portuguese, which may impose a language expectation on users without explicit opt-in. Under the policy, language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script's human-readable prompts, errors, and usage text are written in Portuguese only. This imposes a specific locale on users without any opt-in or documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.