ClawHub
Back to skill

Security audit

DaDaScribe advanced speech-to-text transcription & translation

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent DaDaScribe transcription API guide, but it includes under-scoped handling of sensitive media uploads and an optional unpinned remote package install that deserves review before use.

Review before installing. Use the direct HTTPS API path rather than the optional GitHub pip install unless you pin and inspect the exact commit in an isolated environment. Do not upload private meetings, interviews, medical/legal/business recordings, or copyrighted media unless the user explicitly agrees to send them to DaDaScribe. Keep the API key in an environment variable, avoid logging it, and download outputs only to a controlled directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:184
Finding

Unpinned VCS Dependency Can Execute Mutable Upstream Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 184-187
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install -e .          # from this repo
# or
pip install git+https://github.com/PatzEdi/dadascribe-api-python.git

Technical Analysis

The Skill recommends installing a Python package directly from a mutable GitHub repository reference. The command does not specify an immutable commit hash, signed release, version tag, or integrity hash. Consequently, the code installed by the same documented command can change after the Skill has been reviewed.

Installing a Python project with pip may execute attacker-controlled build-system or installation code. If the upstream repository, maintainer account, release process, or referenced default branch is compromised, following this instruction could execute arbitrary code under the account running the agent.

The alternative local command is also inconsistent with the audited artifact: the project contains only SKILL.md, not the claimed dadascribe package. This increases the likelihood that a user or agent will rely on the unaudited remote installation command.

Attack Path

  1. An attacker compromises the upstream GitHub repository, a maintainer account, or the repository's default branch.
  2. The attacker adds malicious package build or installation logic.
  3. The Skill or an operator executes: pip install git+https://github.com/PatzEdi/dadascribe-api-python.git.
  4. pip retrieves the current attacker-controlled repository contents.
  5. Malicious build or package code executes with the privileges of the user running pip.
  6. The payload can access files, environment variables, network resources, and credentials available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the agent or user ...[truncated 310 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer the documented HTTPS API and avoid installing executable third-party code when it is unnecessary for transcription.
  • If the wrapper is required, use an immutable, reviewed commit hash rather than a mutable branch: pip install git+https://github.com/PatzEdi/dadascribe-api-python.git@COMMIT_HASH.
  • Prefer a trusted package registry release with an exact version and verified distribution hashes.
  • Maintain a lock file or constraints file containing approved versions and hashes.
  • Verify release signatures or attestations where available.
  • Install dependencies in an isolated virtual environment or restricted container without administrative privileges.
  • Remove or correct the claim that the wrapper is present in the same repository unless the reviewed package is actually included.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:143
Finding

Remote Response URLs Are Downloaded Without Destination Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 143-166
Vulnerability Type: Unrestricted remote URL retrieval and unsafe output handling
Risk Level: Medium

Vulnerable Code:

python
def wait_until_complete(job_id, poll_interval=8):
    while True:
        r = requests.post(f"{BASE}/status", json={"id": job_id}, headers=HEADERS, timeout=15)
        r.raise_for_status()
        data = r.json()
        status = data.get("status")
        if status == "complete":
            return data["urls"]
        if status == "error":
            raise RuntimeError(data.get("message", "unknown error"))
        time.sleep(poll_interval)

def download(urls, out_dir="."):
    paths = []
    for url in urls:
        name = url.rsplit("/", 1)[-1]
        path = os.path.join(out_dir, name)
        with requests.get(url, stream=True, timeout=60) as r:
            r.raise_for_status()
            with open(path, "wb") as f:
                for chunk in r.iter_content(8192):
                    f.write(chunk)
        paths.append(path)
    return paths

Technical Analysis

The downloader trusts every URL returned in the remote /status response. It does not validate the URL scheme, hostname, port, expected path prefix, file extension, redirect destination, response content type, or response size.

Although legitimate responses are expected to contain DaDaScribe output URLs, a compromised API, account, DNS path, or service could return an attacker-selected URL. The agent would then send a request to that location. Because requests follows redirects by default, an initially approved-looking URL could also redirect to an internal or attacker-controlled destination.

The response body is written without a maximum size, creating a disk-exhaustion risk. The filename is derived directly from the final URL component without enforcing an expected output naming policy. While path separators ...[truncated 1351 chars]

Remediation
View remediation

Remediation Suggestions

  • Parse every returned URL and require the https scheme.
  • Allowlist the exact expected hostname, port, and path prefix, such as api.dadascribe.com and /v1/output/.
  • Reject URLs containing embedded credentials, fragments, unexpected ports, or malformed encodings.
  • Disable redirects or validate the scheme, host, port, and path again after every redirect.
  • Resolve destinations defensively and reject loopback, link-local, private, multicast, and reserved IP ranges where appropriate.
  • Restrict downloads to expected transcript extensions such as .txt and .srt.
  • Generate local filenames independently or sanitize them against a strict allowlist.
  • Enforce a maximum response size using both Content-Length checks and a running byte limit while streaming.
  • Validate the response content type and delete partial files when validation or download fails.
  • Store outputs in a dedicated, non-executable directory with restrictive permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
94% confidence
Finding

The skill recommends installing a package directly from a remote GitHub repository via pip, which bypasses stronger provenance controls and can execute arbitrary setup/build code during installation. In an agent or automation environment, this creates a software supply-chain risk: if the repository is compromised, renamed, force-pushed, or maliciously updated, arbitrary code execution can occur on the host.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

return paths

Example usage

job_id = transcribe( source="https://www.youtube.com/watch?v=dQw4w9wgccc", source_language="en", destination_language="es,it", diarization="Host,Guest", ) urls = wait_until_complete(job_id) files = download(urls) print("Downloaded:", files)

text

## Using the official Python package (optional)

```bash
pip install -e .          # from this repo
# or
pip install git+https://github.com/PatzEdi/dadascribe-api-python.git
python
from dadascribe import ScribeAPIWrapper
import os

w = ScribeAPIWrapper(os.environ["DADASCRIBE_API_KEY"])
result = w.transcribe(
    source="https://www.youtube.com/watch?v=...",
    source_language="en",
    destination_language="es,it",
)

CLI (after install):

bash
dadascribe --source "https://youtube.com/watch?v=..."
dadascribe --status <job_id>
dadascribe --download <job_id>

Error handling

| HTTP | Typical message | Action | |------|--------

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger/description is broad enough to activate for common requests about transcription, subtitles, translation, podcasts, meetings, interviews, videos, or local files, increasing the chance the agent uses this skill without making clear that user content will be sent to a third-party service. In agent contexts, overbroad auto-matching can cause unintended data disclosure because sensitive audio or video may be transmitted externally without explicit, informed user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description advertises handling local audio/video files but does not prominently warn that those files and their contents will be uploaded to an external API. This creates a privacy and consent risk because users may not realize sensitive recordings, meetings, interviews, or copyrighted media are being transmitted off-platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
# DaDaScribe API Skill

Use the official DaDaScribe API (`https://api.dadascribe.com/v1`) for high-quality AI transcription.

**Base URL:** `https://api.dadascribe.com/v1`  
**API version:** 1.0.1

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
**Limits:**
- Max 10 sources per request
- Max 10 hours per source
- Duplicates are automatically removed
- Rate limit: 60 requests/minute per API key

### 2. Poll status – `POST /status`

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code sends user-provided source information and transcription parameters to an external service, which is expected for the skill but still constitutes real data exfiltration to a third party. In this context the danger is privacy-sensitive rather than overtly malicious, especially because the skill can process local files, meetings, and interviews.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
if diarization:
        payload["diarization"] = diarization

    r = requests.post(f"{BASE}/transcribe", json=payload, headers=HEADERS, timeout=30)
    r.raise_for_status()
    data = r.json()
    if data.get("status") != "ok":

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
def wait_until_complete(job_id, poll_interval=8):
    while True:
        r = requests.post(f"{BASE}/status", json={"id": job_id}, headers=HEADERS, timeout=15)
        r.raise_for_status()
        data = r.json()
        status = data.get("status")