TG Voice Whisper Transcriber

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:27 PM UTC
• Version: 1.0.0

Overview

The skill has a legitimate local voice-transcription purpose, but it uses an always-on watcher and unsafe shell/file handling that users should review before installing.

Review carefully before installing. Only enable this if you are comfortable with continuous private voice-file monitoring and automatic deletion. Prefer a one-shot or explicitly enabled worker with an expiry, run it under a least-privileged account, use pinned dependencies in an isolated environment, and replace the shell/wildcard command with validated per-file processing.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Warning

• Location: SKILL.md:23

Finding

Persistent Background Monitoring Through a Retained Agent or Recurring Cron Job

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-30
Vulnerability Type: Persistent scheduled execution
Risk Level: Medium

Vulnerable Code

text

**Auto-setup (non-block):**
Spawn sub-agent or cron every 5s:

text

sessions_spawn task="LOOP: find /root/.openclaw/media/inbound/*.ogg -mmin -1 → background whisper ru tiny → message reply text → rm" label="voice-auto" cleanup="keep"

text

Or cron:

text

cron add job={"name":"voice-auto","schedule":{"kind":"every","everyMs":5000},"payload":{"kind":"systemEvent","text":"🔊 VOICE_CHECK"},"sessionTarget":"main"}

Technical Analysis

The skill directs the agent to create either a retained background sub-agent using cleanup="keep" or a recurring cron job that runs every five seconds. These mechanisms continue operating beyond a single transcription request and repeatedly monitor a root-owned inbound media directory.

The cron alternative also injects recurring systemEvent messages into the main session. No expiration, execution limit, consent check, duplicate-job prevention, or automatic cleanup mechanism is specified.

Attack Path

1. A user or agent loads the skill and follows its automatic setup instructions.
2. The agent creates a retained voice-auto sub-agent or adds the recurring cron job.
3. The task remains active after the original transcription operation ends.
4. It continuously monitors future .ogg files, transcribes them, sends their contents, and removes them.
5. The process continues until an operator manually discovers and removes the persistent task.

Impact Assessment

The persistent task can continuously process future voice messages accessible under /root/.openclaw/media/inbound/. Its effective privileges are those of the agent or scheduler that creates it. Potential consequences include ongoing monitoring and deletion of inbound media, repeated activity in the main session, r ...[truncated 70 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic creation of retained sub-agents and recurring cron jobs.
• Require explicit, informed authorization before enabling any cross-session monitoring.
• Prefer an event-driven handler that runs only when an authorized voice message arrives.
• If background processing is necessary, enforce a short expiration time, execution limits, duplicate-job prevention, and automatic cleanup.
• Document commands for listing, disabling, and deleting all tasks created by the skill.
• Scope monitoring to a dedicated, least-privileged directory rather than a root-owned general inbound directory.
• Do not inject recurring events into the main session unless the user explicitly enables that behavior.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:18

Finding

Shell Command Injection and Unsafe Wildcard File Handling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-20
Vulnerability Type: OS command injection and unsafe temporary-file handling
Risk Level: High

Vulnerable Code

text

**Usage (agent):**
When voice .ogg arrives in /root/.openclaw/media/inbound/:

text

exec 'whisper PATH --model tiny --language ru --output_format txt --output_dir /tmp/whisper; text=$(cat /tmp/whisper/*.txt); message action=send message="🔊 [text]" reply_to_current; rm PATH /tmp/whisper/*'

Technical Analysis

PATH is inserted directly into a shell command without safe quoting, canonicalization, validation, or argument separation. If the substituted path contains shell metacharacters, command substitutions, whitespace, or option-like components, the shell may interpret part of the filename as executable syntax rather than as one file argument.

The command also uses the shared directory /tmp/whisper and broad wildcards:

• cat /tmp/whisper/*.txt reads every matching transcript, not necessarily only the transcript created for the current message.
• rm /tmp/whisper/* deletes every non-hidden entry in the shared output directory.
• No secure per-operation directory, ownership check, symlink defense, or concurrency control is present.

Consequently, concurrent jobs or another local process able to write to that directory could cause unrelated transcript contents to be included in a reply or unrelated files to be deleted.

Attack Path

1. An attacker causes an .ogg file with a shell-significant filename to be placed in the monitored inbound directory.
2. The agent substitutes that path for PATH in the documented exec command.
3. The shell parses injected metacharacters or command substitution syntax contained in the path.
4. The injected command executes with the same operating-system privileges as the agent.
5. Independently, an attacker or concurrent process can place files in /tmp/whisper ...[truncated 894 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by interpolating the media path.
• Invoke Whisper through an API that accepts an argument array and disables shell parsing, equivalent to shell=false.
• Resolve the canonical input path and verify that it is a regular, non-symlink file inside the expected inbound directory.
• Reject filenames containing unsupported characters and use -- before positional filename arguments where supported.
• Create a private temporary directory for each operation using a secure facility such as mktemp -d, with permissions limited to the agent account.
• Read only the exact output file produced for the current input; do not use *.txt.
• Delete only explicitly tracked input and output paths; do not use rm /tmp/whisper/*.
• Add safe cleanup through a bounded finally or trap handler and account for concurrent transcription jobs.
• Run the transcription worker under a dedicated, unprivileged account with narrowly scoped filesystem access.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned System-Level Python Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-11
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: apt
    packages: [ffmpeg]
  - kind: pip
    packages: [openai-whisper]
    flags: [--break-system-packages]

Technical Analysis

The skill installs openai-whisper without a version constraint or integrity hash. Installation therefore resolves whatever compatible package and transitive dependency versions are available from the configured package index at installation time. The reviewed skill does not establish a reproducible, audited dependency set.

The --break-system-packages flag bypasses Python's externally managed environment protection and allows pip to modify a system-managed Python installation. This increases the possibility of package conflicts, replacement of distribution-managed components, and broad execution of package installation logic with the installer's privileges.

The first-run Whisper model download mentioned elsewhere in the file is also not pinned to a documented digest within this skill, despite the claim that operation is fully offline after installation.

Attack Path

1. An operator installs the skill dependencies.
2. Pip resolves the current unpinned release of openai-whisper and its transitive dependencies from the configured package source.
3. Package build or installation logic executes with the privileges of the installer.
4. A compromised upstream release, compromised package source, or unsafe dependency update can execute code or introduce vulnerable behavior.
5. Because --break-system-packages is used, the installation can also modify or conflict with components in the system Python environment.

No evidence proves that the named package is itself malicious; the risk arises from mutable dependency resolution, absent integrity pinning, and installation into the ...[truncated 411 chars]

Remediation

View remediation

Remediation Suggestions

• Pin openai-whisper and all transitive dependencies to reviewed versions.
• Use a lock file with cryptographic hashes and install with hash verification.
• Obtain packages only from explicitly configured, trusted repositories.
• Install the dependency in a dedicated virtual environment or isolated container.
• Remove --break-system-packages and preserve operating-system package-manager boundaries.
• Run installation and transcription with the minimum required privileges.
• Pin the Whisper model artifact to an approved source and verify its cryptographic digest before use.
• Document all network downloads accurately rather than describing the setup as entirely local without qualification.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description at L03 says the skill is 'fully offline after install,' implying no network activity once installed. However, L40 explicitly documents a 'First run' model download to ~/.cache/whisper/tiny.bin, which contradicts that claim because the code path as documented requires network access unless the model is pre-cached.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition 'When voice .ogg arrives' is broad and lacks explicit validation, source restrictions, size limits, and rate controls. In an agent environment, overly permissive auto-invocation can cause unintended processing of untrusted files, resource exhaustion, or accidental handling of sensitive content without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The command fixes Whisper to --language ru, which imposes a specific language setting rather than allowing user selection or opt-in. This is a natural-language policy concern because it forces a locale/language behavior without presenting a choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The background loop/cron design continuously scans and processes matching files every 5 seconds with no clear scope or lifecycle limits. This increases the risk of runaway resource consumption, repeated processing, and unauthorized transcription of any file placed in the watched directory, especially in shared or multi-agent environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The test command specifies --language ru, reinforcing a fixed language policy in the user-facing instructions. There is no accompanying note that users may choose another language or use detection instead.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.