ClawHub
Back to skill

Security audit

OATDA Transcribe Audio

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it sends user-selected audio to OATDA for transcription using an OATDA API key.

Before installing, treat any audio you transcribe as being sent to OATDA and possibly its configured transcription provider. Avoid using this for confidential, regulated, or third-party recordings unless you are comfortable with that external processing and have the needed consent. Keep the OATDA API key private.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs users to upload local audio files to OATDA's remote transcription API but does not clearly warn that potentially sensitive audio content will leave the local environment and be processed by a third party. In a transcription skill, users may provide meetings, voice notes, or other confidential recordings, so lack of explicit disclosure creates a meaningful privacy and consent risk.

External Transmission

Medium
Category
Data Exfiltration
Content
AUDIO_DATA_URL="data:audio/mpeg;base64,$(base64 -w 0 audio.mp3)"

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X POST "https://oatda.com/api/v1/llm/transcriptions" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OATDA_API_KEY" \
  -d "$(jq -n \
Confidence
95% confidence
Finding
This command explicitly sends audio data, including a base64-encoded local file, to an external API endpoint. External transmission is the core function of the skill, but it is still security-relevant because audio may contain sensitive personal, business, or regulated information and the skill does not enforce confirmation or sensitivity checks before exfiltrating it.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.