Clack

• Outcome: Review
• Latest audit: May 28, 2026 · 9:56 AM UTC
• Version: 1.5.3

Overview

Clack appears to be a real voice relay skill, but it should go to Review because it stores sensitive voice context and tokens while its pairing and auth controls are weaker than the documentation suggests.

Install only on a server you control. Treat the relay token like a password, firewall port 9878, prefer TLS or Tailscale, review the generated systemd unit and config.json permissions, and avoid shared or multi-user deployments unless everyone understands that transcripts and context can be retained and reused across calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 72% confidence
• Finding: The documented purpose emphasizes a voice relay, but the skill also exposes persistent history/context storage, session enumeration, text input, and notably mentions guest-token or Tailscale-IP-based auth bypass behavior not reflected in the top-level description. Hidden or underemphasized auth and data-retention features increase the chance that an operator deploys the service without understanding its true attack surface and privacy implications.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The pairing flow returns the long-lived relay auth token to anyone who can redeem a 6-character code, effectively turning a short code into full server access. Without rate limiting, binding to a device/session, or returning a scoped temporary token instead, this creates a practical brute-force and token-exposure risk.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The server exposes endpoints to read, modify, and delete persistent context and history, which can leak sensitive transcripts or let an attacker manipulate future assistant behavior if the token is obtained. In a voice relay service, storing and remotely managing this data increases the attack surface beyond what users may expect.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script reads the user's OpenClaw config, extracts the gateway token, and offers to modify the gateway configuration to enable the chat completions HTTP endpoint. Even though it prompts before changing the setting, this expands the attack surface of the local gateway and reaches beyond a minimal voice-relay install by altering another service's security-relevant configuration.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The server persists full conversation history to disk and exposes it through HTTP endpoints, which exceeds a narrow transient voice-relay function and increases the blast radius of compromise or misuse. In a voice system, transcripts may contain sensitive spoken data, so retaining and serving them without strong scoping, encryption, or opt-in creates a real privacy and data-exposure risk.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The pairing flow returns the long-lived relay auth token to anyone who presents a valid pairing code or guest token, effectively making this service a token distribution endpoint. That expands the trust boundary beyond a simple relay and creates a strong credential-exposure risk, especially because the returned token can likely be reused across other endpoints and sessions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The service exposes endpoints to set and persist arbitrary user context that is later injected into the model's system prompt, giving clients a durable channel to influence future model behavior. Because this context survives beyond a single request and is shared via disk-backed state, it materially increases the risk of semantic prompt injection and cross-session manipulation.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Persisting shared conversation history across calls creates a real privacy and data-leakage risk, especially in a voice assistant context where users may assume sessions are ephemeral. Cross-call retention can expose prior users' sensitive transcripts to anyone with the relay token or administrative access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup script reads a sensitive gateway token from the user's OpenClaw config and later persists multiple API keys and tokens to disk without a strong up-front warning about where secrets will be stored. This creates credential exposure risk through local file disclosure, backups, process/service inspection, or accidental sharing of the skill directory and systemd unit contents.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill sends user audio and text to third-party STT/TTS/LLM providers, which is expected for the feature, but there is no clear consent or disclosure at the transmission points in this code. For voice interactions, users may disclose highly sensitive spoken content, so silent transmission to external processors is a meaningful privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Conversation history is written to disk without any explicit notice, opt-in, encryption, or per-user isolation. Since voice transcripts can contain personal or confidential information, silent persistence increases privacy risk and makes later unauthorized disclosure more damaging.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: User-provided context is stored on disk without an explicit warning, though it may contain sensitive background facts, preferences, or instructions. Persisting that data silently creates privacy risk and increases the chance of unintended reuse across sessions.

Ssd 1

High

• Confidence: 97% confidence
• Finding: The session accepts an arbitrary client-supplied systemPrompt and uses it as the base system instruction, allowing an untrusted client to override or remove the built-in safety constraints. This can directly weaken safeguards around destructive actions and cause the backend LLM to follow attacker-controlled high-priority instructions.

Ssd 1

High

• Confidence: 96% confidence
• Finding: Persisted user context is concatenated into the system prompt as trusted instructions, even though it can be set through HTTP or WebSocket APIs. That lets anyone with access to those APIs plant prompt-injection content that persists across sessions and influences future model behavior as if it were trusted policy.

Ssd 1

High

• Confidence: 98% confidence
• Finding: The code injects user-controlled context directly into the system prompt, which gives untrusted input privileged influence over model behavior. In a voice relay that can interact with an agent backend, this can be exploited to alter safeguards, steer outputs, or poison future interactions across sessions.

Ssd 1

High

• Confidence: 99% confidence
• Finding: Allowing clients to override the system prompt directly lets any authenticated client redefine the model's top-level behavior and potentially disable safety constraints. In this architecture, that is especially dangerous because the relay fronts an agent/gateway and may influence actions or sensitive responses beyond simple chat styling.

Session Persistence

Medium

• Category: Rogue Agent

Content

val=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('$varname',''))" 2>/dev/null || true)
    if [[ -n "$val" ]]; then export "$varname=$val"; fi
  fi
  # Fallback: read from systemd service file (legacy installs)
  if [[ -z "${!varname:-}" && -f "$SERVICE_FILE" ]]; then
    local val
    val=$(grep -oP "^Environment=${varname}=\K.*" "$SERVICE_FILE" 2>/dev/null || true)

• Confidence: 90% confidence
• Finding: systemd service file (legacy install

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.