ClawHub
Back to skill

Security audit

DaDaScribe advanced speech-to-text transcription & translation

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward DaDaScribe transcription helper, but users should understand that media and related metadata are sent to DaDaScribe and avoid unreviewed optional package installs.

Install only if you are comfortable sending audio or video content, source URLs, speaker labels, and requested translation settings to DaDaScribe for processing. For confidential meetings, interviews, or regulated content, confirm consent and data-handling requirements first. Prefer the documented HTTP API path, and review or pin the optional GitHub package before installing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly supports sending local audio/video files and remote media to a third-party transcription API, but the description does not clearly warn users that potentially sensitive voice, meeting, interview, or other private content will leave the local environment. In this context, omission of a privacy/data-sharing warning is security-relevant because users may unknowingly transmit confidential data to an external processor.

External Transmission

Medium
Category
Data Exfiltration
Content
if diarization:
        payload["diarization"] = diarization

    r = requests.post(f"{BASE}/transcribe", json=payload, headers=HEADERS, timeout=30)
    r.raise_for_status()
    data = r.json()
    if data.get("status") != "ok":
Confidence
97% confidence
Finding
requests.post(f"{BASE}/transcribe", json=

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Content
```bash
pip install -e .          # from this repo
# or
pip install git+https://github.com/PatzEdi/dadascribe-api-python.git
```

```python
Confidence
90% confidence
Finding
pip install git+https://

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:23