ClawHub
Back to skill

Security audit

Voice Transcription

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward transcription skill that sends selected audio to SiliconFlow, with privacy and credential-handling caveats but no hidden, destructive, or persistence behavior found.

Install only if you are comfortable sending audio files to SiliconFlow for transcription. Avoid using the documented --api-key command form for real credentials; use a protected environment variable or secret store instead, and do not process confidential recordings without confirming the provider's privacy and retention terms.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/transcribe.py:86
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/transcribe.py:86-94; documented usage at SKILL.md:41-43
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

scripts/transcribe.py:86-94:

python
parser.add_argument("--api-key", "-k", help="SiliconFlow API Key (也可设置环境变量 SILICONFLOW_API_KEY)")
parser.add_argument("--output", "-o", help="输出文件路径 (默认输出到 stdout)")
parser.add_argument("--json", action="store_true", help="以 JSON 格式输出")

args = parser.parse_args()

# 获取 API Key
api_key = args.api_key or os.environ.get("SILICONFLOW_API_KEY", "")
if not api_key:

SKILL.md:41-43:

bash
# 指定 API Key
python3 scripts/transcribe.py audio.mp3 --api-key sk-xxx

Technical Analysis

The script accepts a sensitive SiliconFlow API key as a command-line argument, and the documentation explicitly recommends this invocation method. Command-line arguments are not an appropriate secret transport mechanism because they may be:

  • Recorded in shell history.
  • Captured by command-execution telemetry or audit logs.
  • Visible to sufficiently privileged local users through process inspection facilities while the command is running.
  • Retained in terminal session logs or automation logs.

The API key is not hardcoded or intentionally transmitted anywhere other than the declared SiliconFlow API endpoint. Nevertheless, accepting and documenting command-line secret input unnecessarily increases credential exposure. The already-supported SILICONFLOW_API_KEY environment variable is safer than the documented argument, although protected credential storage or an interactive secret prompt would be preferable.

Attack Path

  1. A user follows the documented example and invokes the script with --api-key sk-xxx.
  2. The complete command is stored in shell history, execution telemetry, a process listing, or an automation log.
  3. An ...[truncated 847 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove or deprecate the --api-key command-line option.
  2. Remove the command-line API-key example from SKILL.md.
  3. Prefer a secret supplied through a protected credential manager or configuration file with restrictive permissions.
  4. If an environment variable remains supported, document that it should be set without placing the key directly in reusable shell commands.
  5. Optionally use getpass.getpass() to request the credential interactively when no protected configuration is available.
  6. If backward compatibility requires retaining --api-key, emit a clear warning explaining that command-line secrets may be exposed through shell history, process inspection, and logs.
  7. Rotate any key that has already been placed in shared shell history, CI logs, or execution telemetry.

T08 · Insecure Dependencies

Note
Location
SKILL.md:9
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:9-13
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Low

Vulnerable Code

yaml
install:
  - id: requirements
    kind: pip
    packages: ["requests"]
    label: "Install Python requests library"

Technical Analysis

The installation configuration requests requests without specifying a reviewed version or integrity hash. Consequently, the package version and its transitive dependencies are resolved at installation time rather than being reproducibly fixed.

The dependency name is legitimate and there is no evidence that the project intentionally references a malicious, misspelled, or privately shadowed package. The risk arises from mutable dependency resolution: a compromised upstream release, compromised package index, or unexpectedly incompatible future release could alter installation or runtime behavior after the Skill has been reviewed.

Because package installation and imported package initialization execute code in the installing user's context, a malicious dependency release could act with that user's permissions.

Attack Path

  1. An attacker compromises an upstream package release, dependency, maintainer account, or package-distribution channel.
  2. A user installs the Skill after the compromised version becomes the version selected by pip.
  3. The unpinned declaration resolves and downloads the affected package or transitive dependency.
  4. Malicious code executes during installation or when requests is imported and used by scripts/transcribe.py.
  5. The payload acts with the privileges of the user or service account installing or running the Skill.

This path depends on an external supply-chain compromise; no malicious dependency is currently demonstrated by the audited files.

Impact Assessment

In the event of an upstream compromise, the dependency could access files, environment varia ...[truncated 422 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin requests to a reviewed, compatible version rather than resolving an unrestricted latest version.
  2. Lock all transitive dependencies to reviewed versions.
  3. Use package hashes, such as pip hash-checking mode, to verify downloaded artifacts.
  4. Maintain a lock file or reproducible requirements file and update it through a controlled dependency-review process.
  5. Run dependency vulnerability scanning whenever the lock file is changed.
  6. Where practical, consider using Python's standard HTTP libraries to eliminate the third-party runtime dependency.
  7. Install dependencies in an isolated, least-privileged virtual environment rather than a privileged or system-wide Python environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares installation and execution requirements that imply environment access, network access, and likely file output, but it does not declare any explicit tool scope or permissions boundaries. This creates a least-privilege and transparency problem: the agent may invoke the skill without clear user/admin visibility into what resources it can access, increasing the chance of unintended data exposure or overly broad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documentation does not clearly warn users that uploaded audio will be sent to SiliconFlow, an external third-party API, for processing. This is dangerous because audio often contains sensitive personal, business, or regulated information, and users may reasonably assume local processing unless external transfer is disclosed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation guidance uses broad conversational triggers such as references to 'listen to this recording' or 'speech-to-text,' which can overlap with ordinary user dialogue. That raises the risk of accidental skill activation on sensitive audio, causing unintended transmission of files or content to the transcription backend without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains user-facing natural-language strings exclusively in Chinese, starting with the module docstring and continuing through CLI descriptions and error messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation because users are not offered any locale choice or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This script uploads local audio files and an API credential to an external third-party service for transcription. In a skill context, that creates a real data-exfiltration boundary: sensitive audio content may leave the local environment, and users may not fully appreciate the privacy, compliance, or confidentiality implications.

Content

Scanner excerpt · scripts/transcribe.py (reported line 18)May include surrounding context.

python
print("错误: 需要 requests 库，请运行: pip3 install requests", file=sys.stderr)
    sys.exit(1)

API_URL = "https://api.siliconflow.cn/v1/audio/transcriptions"
AVAILABLE_MODELS = ["FunAudioLLM/SenseVoiceSmall", "TeleAI/TeleSpeechASR"]
MAX_FILE_SIZE = 50 * 1024 * 1024  # 50MB