ClawHub
Back to skill

Security audit

gladia-documentation-auto

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Gladia transcription documentation skill, but users should remember that audio or video sent through it goes to Gladia's external API.

Install this only if you want agents to help with Gladia transcription workflows. Before using it on recordings, confirm that the user intends to send audio/video and related metadata to Gladia, use an appropriate API key, and avoid sensitive or regulated recordings unless your privacy, retention, and approval requirements are satisfied.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The manifest description explicitly positions this as a 'general-purpose fallback' when specialized skills do not match, which can cause the agent to invoke this skill for loosely related prompts. Because the skill includes instructions for external API use and data transfer, over-broad matching increases the chance of unnecessary collection or transmission of user audio/video to a third party.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill provides detailed instructions to upload files and stream live audio/video to Gladia, but it does not include a clear user-facing warning that content will leave the local environment and be processed by an external service. In a speech-to-text context, this can expose sensitive conversations, PII, or regulated data if the agent applies the workflow without informed user consent.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "x-gladia-key: YOUR_KEY" \
     -H "Content-Type: application/json" \
     -d '{
       "audio_url": "https://api.gladia.io/file/...",
       "model": "solaria-3",
       "language_config": { "languages": ["en"] },
       "diarization": true
Confidence
91% confidence
Finding
https://api.gladia.io/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.