ClawHub
Back to skill

Security audit

Voice Transcribe

Security checks across malware telemetry and agentic risk

Overview

This audio transcription skill is not clearly malicious, but it needs review because it can process private voice recordings through OpenAI using an unbundled hard-coded local transcribe command.

Install only if you trust or can separately inspect the local transcribe command that will actually run. Use a dedicated OpenAI API key, avoid transcribing sensitive or third-party recordings without consent, and check where transcripts or cached data are stored and how to delete them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This markdown file describes transcribing local audio files with OpenAI's model, which implies user audio data will be transmitted to an external service. The skill description does not explicitly warn about this privacy-relevant behavior or advise users that voice memo contents leave the local system.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
The notes state 'assumes english (no language detection)', which imposes a language constraint without offering user opt-in or documenting a justified regional or compliance reason. This is a natural-language policy concern because it hard-codes a locale/language expectation rather than allowing user choice.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.