T09 · Insecure Skill Coding Practices
Note
- Location
scripts/voice_journal_ctl.js:66- Finding
Unverified Stale PID Can Terminate an Unrelated Process
- Content
View full analysis
- Remediation
View remediation
Security audit
Voice Log
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed voice-journaling skill that records microphone audio, sends it to Soniox for transcription, and stores a rolling local transcript while running.
Install only if you are comfortable with a background process recording microphone audio, sending it to Soniox, and keeping a rolling local transcript for up to 60 minutes. Stop it when finished, avoid using it around people who have not consented, and consider pinning the Soniox dependency before sensitive use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This skill is explicitly designed to capture microphone audio continuously, convert it to text, and store conversation logs, which creates a real context-leakage path for sensitive spoken information. The risk is elevated because data is both transmitted to a cloud STT provider and retained locally, so confidential discussions, bystander speech, or unrelated secrets may be exposed.
- Content
md metadata: {"openclaw":{"requires":{"bins":["node","arecord|rec|ffmpeg"],"env":{"SONIOX_API_KEY":"required - Soniox API key"},"note":"Captures microphone audio locally and streams audio to Soniox realtime STT only while journal is running."}}} --- # Voice log Conversation journal that uses Soniox realtime STT in a background daemon that: - Captures microphone audio continuously.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/voice_journal_ctl.js start
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares environment requirements and operational behavior but does not define an explicit tool/permission scope. In an agent setting, missing scope boundaries can let the runtime or orchestrator invoke the skill without clear consent or least-privilege controls, especially for microphone capture and external network use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description enables passive microphone capture and cloud transcription without a prominent privacy warning. Users may trigger the skill without understanding that ambient speech will be captured and sent to a third-party service, creating consent and data exposure risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest explicitly advertises background speech-to-text, rolling logs, and conversation recap, but it does not disclose that audio may be continuously captured and sent to a third-party provider using a required Soniox API key. In a voice journaling skill, this omission is security-relevant because users may trigger passive logging without understanding the privacy implications, leading to unintended collection, retention, or transmission of sensitive conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The
last()command prints raw journal transcript content directly to stdout, which can expose highly sensitive personal speech data to any caller, logs, terminal history, or upstream agent without an explicit warning, confirmation, or access-control check. In this skill’s context, the data is especially privacy-sensitive because it captures passive/background conversation, so accidental disclosure is a realistic risk even if the behavior is intentional.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This daemon captures microphone audio continuously and sends it to Soniox for transcription, but this file contains no user-facing notice, consent check, or runtime indicator before recording/transmission begins. In the context of a background voice journaling skill, silent capture and export of ambient speech can expose highly sensitive conversations and create significant privacy and compliance risk if started unexpectedly or without explicit informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly performs background speech-to-text logging and requires a third-party Soniox API key, yet the user-facing description does not clearly warn that live conversation audio may be captured and transmitted to an external service. This creates a meaningful privacy and consent risk because users may enable passive logging without understanding that sensitive speech could be recorded and shared off-device.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill states that it keeps a text-only log for the latest 60 minutes, but this retention is not surfaced as an explicit privacy warning in the user-facing description. Hidden or understated retention increases the chance that sensitive conversation content is stored locally without informed user awareness.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The dependency uses a caret range, which allows automatic adoption of future 1.x releases of @soniox/node without review. For a skill that captures and transmits live conversation data, an unexpected upstream change or compromised release could alter data handling or introduce malicious behavior into a highly sensitive execution path.
- Content
json "last-journal": "node scripts/voice_journal_ctl.js last" }, "dependencies": { "@soniox/node": "^1.1.1" } }
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code writes transcribed speech into local journal files, but this file provides no disclosure to the user that conversation content will be retained on disk. Even with best-effort file permission hardening, local persistence of sensitive transcripts increases exposure to later unauthorized access, accidental sharing, or forensic recovery, especially on shared or lightly managed systems.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/voice_journal_ctl.js:102
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/voice_journal_daemon.js:146