Mlx Stt

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:33 AM UTC
• Version: 0.1.0

Overview

This is a straightforward local speech-to-text skill, with a disclosed but somewhat loose third-party install step users should verify before use.

Before installing, verify the mlx-audio package source and consider pinning an exact reviewed version instead of allowing prereleases. Expect the skill to read audio files you provide and run local speech-to-text processing, potentially through a local OpenClaw STT service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Prerelease Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17
Vulnerability Type: Unpinned and prerelease-enabled dependency installation
Risk Level: Medium

Vulnerable Code:

markdown

> **Note:** This plugin depends on the `mlx-audio` Python library. Ensure it is installed before use:
> ```bash
> uv tool install mlx-audio --prerelease=allow
> ```

Technical Analysis

The documented installation command retrieves mlx-audio from a third-party package registry without specifying an audited version or cryptographic integrity hash. It also explicitly permits prerelease versions.

Dependency resolution consequently depends on mutable registry state at installation time. Different users or installation dates may resolve to different package versions, including versions that were never reviewed alongside this Skill. If the package, its publishing account, its build dependencies, or another component in its dependency chain is compromised, installation or subsequent execution could run attacker-controlled code.

The project contains only SKILL.md and does not include the implementation of the documented mlx_stt tool. Therefore, the artifact itself cannot verify the integrity of the installed component or substantiate the claim that all processing remains local.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or another relevant supply-chain component.
2. The attacker publishes a malicious version eligible for resolution by the unpinned command, potentially as a prerelease.
3. A user follows the Skill documentation and runs uv tool install mlx-audio --prerelease=allow.
4. The package manager resolves and installs the attacker-controlled release or dependency.
5. Malicious code executes during a source-package build, package invocation, or subsequent transcription operation with the privileges of the user running the tool.
6. That code co ...[truncated 622 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mlx-audio to an exact, reviewed release rather than allowing unconstrained resolution.
2. Remove --prerelease=allow unless a prerelease is strictly required. If it is required, pin the exact audited prerelease and document why it is necessary.
3. Maintain a lockfile containing exact direct and transitive dependency versions.
4. Require cryptographic hashes for downloaded distributions where the package-management workflow supports them.
5. Document the expected package registry and reject unexpected indexes or alternate dependency sources.
6. Prefer reviewed binary distributions from trusted publishers and carefully assess source distributions and their build backends.
7. Perform dependency vulnerability and provenance checks in CI before updating the approved version.
8. Run the transcription service with least privilege and restrict its filesystem and network access to limit the impact of a compromised dependency.
9. Include or reference a verifiable implementation so reviewers can validate the documented local-only processing claim.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill description, trigger phrases, parameter explanations, and usage instructions are written only in Chinese, which effectively imposes a specific language for interacting with or understanding the skill. The policy allows locale constraints only when clearly documented and justified or when users are given a language/locale choice, neither of which is present here.

Content

No source excerpt is available for this finding.