ClawHub
Back to skill

Security audit

SenseAudio Voice CN

Security checks for vulnerabilities and agentic risk

Overview

This voice skill uses cloud speech services and local audio files in ways that match its stated purpose, with some setup and privacy caveats users should understand.

Install only if you are comfortable sending text/audio to SenseAudio or Microsoft Edge TTS and storing generated files locally. Prefer a dedicated SENSE_API_KEY, avoid sensitive recordings, review the extra OpenClaw config lookup, and install dependencies in a virtual environment with pinned versions when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:12
Finding

Unpinned Python dependency installation permits supply-chain substitution

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh, lines 12-15
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
# Install requests library (the only dependency)
echo "📦 Installing Python dependencies..."
pip3 install requests --quiet
echo "   ✅ requests installed"

Technical Analysis

The setup script installs requests directly from the Python package index without an exact version, integrity hash, lockfile, isolated virtual environment, or explicit trusted index. Consequently, installation results can change over time without any modification to the reviewed Skill.

Although requests is a legitimate and widely used dependency, the command resolves its latest compatible release and its transitive dependencies at installation time. If the package publisher, package index, configured mirror, DNS/proxy infrastructure, or a transitive dependency is compromised, a malicious distribution could be selected.

Python package installation can execute build-backend code while processing source distributions. A malicious package can therefore execute code during pip3 install, before the Skill imports or invokes the dependency. The absence of a virtual environment also allows the command to modify the invoking user's global or user-level Python environment.

The same supply-chain concern applies to the documentation's unpinned pip install edge-tts instruction, but the directly executable installation sink is the command shown above.

Attack Path

  1. An attacker compromises the requests publishing account, a transitive dependency, the configured Python index or mirror, or another component in the package-resolution path.
  2. The attacker publishes or serves a malicious package version or source distribution.
  3. A user executes scripts/setup.sh.
  4. pip3 install requests --quiet resolves the attacker-controlled artifact because ...[truncated 1296 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive Python dependency to an reviewed version in a dedicated requirements or lock file.

  2. Record cryptographic hashes and enforce them during installation:

    text
    requests==2.32.5 \
    --hash=sha256:<verified-wheel-hash>
    bash
    python3 -m pip install \
  --require-hashes \
  --only-binary=:all: \
  -r requirements.txt

  3. Generate and review a fully resolved lock file with tooling such as pip-compile, including hashes for all transitive dependencies.

  4. Install dependencies into a Skill-specific virtual environment rather than the global Python environment:

    bash
    python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.txt

  5. Use python3 -m pip instead of a standalone pip3 command to ensure dependencies are installed for the intended interpreter.

  6. Explicitly configure the approved package index and prevent fallback to untrusted extra indexes.

  7. Remove --quiet during security-sensitive installation or emit the resolved versions and artifact sources so users can audit what was installed.

  8. Pin edge-tts and its transitive dependencies in the same lock file rather than directing users to run an unpinned installation command.

  9. Add automated dependency scanning and a controlled update process in which version and hash changes are reviewed before release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (37)

Tainted flow: 'headers' from os.environ.get (line 58, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/asr.py (reported line 80)May include surrounding context.

python
data["target_language"] = translate_to
    
    try:
        response = requests.post(DEFAULT_ASR_URL, headers=headers, files=files, data=data, timeout=120)
        response.raise_for_status()
        
        result = response.json()

Tainted flow: 'headers' from os.environ.get (line 283, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tts.py (reported line 305)May include surrounding context.

python
}
    
    try:
        response = requests.post(DEFAULT_TTS_URL, headers=headers, json=payload, timeout=timeout)
        response.raise_for_status()
        
        data = response.json()

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description omits or understates several security-relevant behaviors: creating/storing audio files locally, invoking local system players, reading credentials from config/environment, and using third-party services beyond the named provider. These undeclared behaviors reduce transparency and informed consent, and can lead to credential exposure, unexpected persistence of sensitive audio/text, or execution of local commands in environments where such actions are restricted.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description omits or understates several security-relevant behaviors: creating/storing audio files locally, invoking local system players, reading credentials from config/environment, and using third-party services beyond the named provider. These undeclared behaviors reduce transparency and informed consent, and can lead to credential exposure, unexpected persistence of sensitive audio/text, or execution of local commands in environments where such actions are restricted.

Content

No source excerpt is available for this finding.

Tainted flow: 'files' from open (line 63, file read) → requests.post (network output)

High
Category
Data Flow
Confidence
80% confidence
Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/asr.py (reported line 80)May include surrounding context.

python
data["target_language"] = translate_to
    
    try:
        response = requests.post(DEFAULT_ASR_URL, headers=headers, files=files, data=data, timeout=120)
        response.raise_for_status()
        
        result = response.json()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documentation presents fixed language-to-engine routing that automatically sends Chinese text to SenseAudio and English/Japanese text to Edge TTS, without emphasizing informed user choice or privacy implications of provider selection. This can cause users to transmit content to a service they did not intend to use, especially when language detection is automatic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README instructs users to store a sensitive API key and to send TTS content to remote services, but it does not clearly warn that text and credentials are being transmitted to third-party providers. In a voice skill, users may reasonably assume local processing unless documentation explicitly states otherwise, so this omission creates privacy and secret-handling risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

python tts.py --check-players

安装推荐播放器

sudo apt-get install alsa-utils # aplay (WAV 原生支持) sudo apt-get install pulseaudio # paplay sudo apt-get install ffmpeg # ffplay (多格式支持)

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

python tts.py --check-players

安装推荐播放器

sudo apt-get install alsa-utils # aplay (WAV 原生支持) sudo apt-get install pulseaudio # paplay sudo apt-get install ffmpeg # ffplay (多格式支持)

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 129)May include surrounding context.

python tts.py --check-players

安装推荐播放器

sudo apt-get install alsa-utils # aplay (WAV 原生支持) sudo apt-get install pulseaudio # paplay sudo apt-get install ffmpeg # ffplay (多格式支持)

text

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises behavior that requires network access, local file read/write, environment/config access, and shelling out to local audio players, but it declares no explicit tool scope or permissions. In an agent environment, this weakens isolation and informed consent because the runtime may grant broader capabilities than users expect, enabling unintended data access or command execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation promotes automatic playback and local storage without clearly warning that user-supplied text and generated audio may be transmitted to third-party services and persisted on disk. In a voice skill, prompts may contain sensitive personal, workplace, or educational content, so insufficient disclosure can lead to unintentional data leakage and retention.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/asr.py (reported line 18)May include surrounding context.

python
import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/asr.py (reported line 50)May include surrounding context.

python
import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 25)May include surrounding context.

python
import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 270)May include surrounding context.

python
import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script reads credentials not only from the expected environment variable but also from unrelated local OpenClaw config paths, including a specific agent directory. This broadens secret sourcing in a surprising way and can cause accidental credential use or cross-skill secret exposure if another local config contains a valid API key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script uploads potentially sensitive audio content to a third-party cloud ASR service without an explicit privacy warning or affirmative consent step at runtime. In a skill context, users may treat a local script as on-device processing and unintentionally transmit personal, confidential, or regulated voice data externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file's comments, status messages, and example usage are written in Chinese throughout, which effectively forces a single language for users interacting with the skill. Under the policy, locale or language constraints should either be optional for the user or clearly documented as a justified regional restriction.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 27)May include surrounding context.

sh
echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tts.py (reported line 400)May include surrounding context.

python
echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tts.py (reported line 527)May include surrounding context.

python
echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tts.py (reported line 528)May include surrounding context.

python
echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tts.py (reported line 529)May include surrounding context.

python
echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Static analysis

No suspicious patterns detected.