ClawHub
Back to skill

Security audit

OATDA Translate Audio

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward OATDA audio translation helper that uploads user-selected audio to OATDA for English translation.

Before installing, understand that audio files you ask the agent to translate will be uploaded to OATDA using your OATDA API key; avoid using it for sensitive recordings unless you are comfortable with OATDA processing that content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill processes user-supplied audio by sending it to OATDA's remote API, but it does not clearly warn users in the main description or workflow that uploaded audio leaves the local environment and is transmitted to a third party. Because audio often contains sensitive personal, business, or regulated content, the lack of explicit disclosure can cause unintended data exposure and weakens informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
AUDIO_DATA_URL="data:audio/mpeg;base64,$(base64 -w 0 audio.mp3)"

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X POST "https://oatda.com/api/v1/llm/translations" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OATDA_API_KEY" \
  -d "$(jq -n \
Confidence
95% confidence
Finding
This command base64-encodes the local audio file and sends it in a POST request to OATDA's external API, which is an explicit transmission of potentially sensitive user data to a third party. In the context of an audio translation skill this behavior is expected, but it remains security-relevant because private recordings may be exfiltrated off-host without sufficient user awareness or consent.

Static analysis

No suspicious patterns detected.