ClawHub
Back to skill

Security audit

Willow Inference Server

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for local speech transcription and text-to-speech, but its setup tells users to run unpinned code from an external GitHub repository.

Review before installing. Only run the setup from a pinned and trusted Willow server revision, inspect utils.sh before execution, and avoid using elevated privileges unless the upstream installer clearly requires them. Send audio recordings or text only to a Willow server you trust and control, especially for meetings, personal speech, confidential prompts, or regulated data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:15
Finding

Unpinned Remote Repository Is Downloaded and Executed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill repeatedly instructs users to send potentially sensitive audio recordings and text content to a server endpoint, but it does not include a clear privacy, retention, logging, or data-handling warning. Even though the server is described as local, the examples use a configurable hostname and could point to a remote system, creating a real risk of unintended disclosure of conversations, PII, or confidential text.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This example transmits user audio files to ${WILLOW_BASE_URL}/asr, which is an external network operation from the client perspective and may expose sensitive speech content if the server is remote, compromised, or misconfigured. The danger is increased because the documentation normalizes direct upload of recordings without warning users about trust boundaries or data sensitivity.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Supported Formats

  • MP3, WAV, M4A, OGG, FLAC, WebM

Example: Transcribe with curl

bash
# Basic transcription
curl -X POST "${WILLOW_BASE_URL}/asr" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This TTS example sends arbitrary user text to the server, which can leak confidential prompts, personal information, or proprietary content if the endpoint is not fully trusted. Although TTS requires server-side processing by design, the skill omits a warning that submitted text leaves the client and may be logged or retained by the server.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

Check server docs for full list: ${WILLOW_BASE_URL}/api/docs

Example: TTS with curl

bash
# Basic TTS
curl -X POST "${WILLOW_BASE_URL}/tts" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The workflow examples encourage recording and immediately uploading audio for transcription, which increases the chance that users send sensitive spoken content without considering where it is processed. In the context of an ASR/TTS skill, this behavior is expected, but the absence of explicit privacy and trust-boundary guidance makes the transmission risky rather than merely informational.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

rec test.wav

Transcribe

curl -X POST "${WILLOW_BASE_URL}/asr"
-F "audio_file=@test.wav"
-F "language=auto"

text