ClawHub
Back to skill

Security audit

Addis Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do the promised speech-to-text and translation work, but it handles API keys and user audio/text in ways that deserve review before installation.

Review before installing. Use only if you trust Addis Assistant with the submitted audio and text, avoid sensitive content unless approved, and prefer a revised version that uses explicit HTTPS endpoints and reads API keys from an environment variable or secret store instead of command-line arguments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/stt.py:23
Finding

Sensitive API requests do not enforce HTTPS

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/stt.py:23
Finding

API keys are exposed through process command-line arguments

Content
View full analysis
[language_code]") sys.exit(1) api_key = sys.argv[1] audio_file_path = sys.argv[2] language_code = sys.argv[3] if len(sys.argv) > 3 else "am" ``` `scripts/translate.py:33-44`: ```python command = [ "curl", "--location", "api.addisassistant.com/api/v1/translate", "--header", "Content-Type: application/json", "--header", f"x-api-key: {api_key}", "--data", data ] ``` `scripts/translate.py:56-65`: ```python if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python3 translate.py ") sys.exit(1) api_key = sys.argv[1] text = sys.argv[2] source_language = sys.argv[3] target_language = sys.argv[4] run_translate(api_key, text, source_language, target_language) ``` ### Technical Analysis The scripts require the API key as the first command-line argument. Command-line arguments may be retained in shell history and captured by terminal logging, job schedulers, diagnostic systems, process monitoring agents, or audit telemetry. The scripts then place the same key in the child curl process's argument vector as the value of an `x-api-key` header. This creates another opportunity for exposure through process inspection or command logging. Although operating ...[truncated 1638 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code chunk is narrowly focused on STT: it validates an API key and audio file path, then calls api.addisassistant.com/api/v2/stt with multipart form data containing the audio file and language code. This aligns with the declared STT portion, including Amharic as the default language. However, the declared description also states that the skill provides text translation, and no translation logic, endpoint, or text-processing behavior appears in this code. Therefore the description overstates the implemented capabilities for the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code chunk exclusively handles translation: it validates an API key, text, source language, and target language, then calls api.addisassistant.com/api/v1/translate. There is no audio input handling, no speech recognition logic, and no STT endpoint usage. Therefore, the description materially overstates the implemented functionality by claiming Speech-to-Text support when the code only performs translation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises executable scripts and detected shell-capable behavior but does not declare any tool scope restrictions such as permissions or allowed-tools. In agent environments, this can lead to over-broad execution authority, making it easier for the skill to invoke shell functionality or related capabilities without explicit review or containment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill processes potentially sensitive audio and text by sending them to a third-party API, but the user-facing description does not clearly warn that this content leaves the local environment. This creates a privacy and data-governance risk, especially for speech transcripts, personal conversations, or confidential text that users may reasonably expect to remain local unless told otherwise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The API spec clearly describes sending user-provided audio files and text to api.addisassistant.com, but it does not warn that potentially sensitive content leaves the local environment and is transmitted to a third-party remote service. In a speech-to-text and translation skill, this omission can mislead integrators or users into submitting confidential audio, personal data, or regulated content without informed consent or appropriate handling controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This endpoint intentionally transmits an audio file and request metadata to an external service, which creates a real data-exposure boundary even if it is the expected function of the skill. The danger is contextual rather than exploit-like: users may provide sensitive voice content, and without strong disclosure and trust controls, that content could be exposed to a remote processor, logged, retained, or mishandled.

Content

Scanner excerpt · references/api_spec.md (reported line 9)May include surrounding context.

Method: POST

bash
curl --location 'api.addisassistant.com/api/v2/stt' \
 --header 'x-api-key: Your-api-key' \
 --form 'audio=@"/path/to/file.wav"' \
 --form 'request_data="{ \"language_code\": \"am\" }"'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The function defaults language_code to "am", and the CLI path also silently applies that default when the user does not specify a language. This imposes a specific language choice without opt-in or an accompanying justification that the tool is region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/stt.py (reported line 37)May include surrounding context.

python
]

    try:
        result = subprocess.run(command, capture_output=True, text=True, check=True)
        print(result.stdout)
    except subprocess.CalledProcessError as e:
        print(f"Error during STT API call: {e.stderr}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/translate.py (reported line 48)May include surrounding context.

python
]

    try:
        result = subprocess.run(command, capture_output=True, text=True, check=True)
        print(result.stdout)
    except subprocess.CalledProcessError as e:
        print(f"Error during STT API call: {e.stderr}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Accepting the API key via command-line argument can expose the secret to other local users through process listings, shell history, audit logs, job runners, or crash reports. In an agent skill context, this is more dangerous because operators may routinely paste secrets into automation commands, increasing the chance of credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits arbitrary user text and the API key to a remote third-party service, but provides no user-facing notice, consent step, or data-handling warning. In a translation skill, submitted text may contain sensitive personal, business, or regulated information, so silent transmission creates a privacy and secret-exposure risk if users or integrators do not realize data leaves the local environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.