ClawHub
Back to skill

Security audit

gladia-sdk-integration

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Gladia SDK setup skill with expected guidance for installing SDKs and sending audio to Gladia for transcription.

Install only if you intend to integrate Gladia's transcription service. Keep API keys server-side, avoid embedding them in browser code, obtain consent before microphone capture, and only send audio files or URLs that you are allowed to share with Gladia.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The microphone streaming example captures live audio from the user's environment and sends it to a remote transcription service, but the documentation does not warn about consent, privacy, or transmission to a third party. In an SDK setup guide, this omission can lead developers to embed always-on or insufficiently disclosed audio capture flows, increasing the risk of privacy violations and noncompliant deployments.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The URL transcription example shows that a remote URL can be passed directly for processing, but it does not state that the service will fetch that remote content and process it externally. This can mislead developers about data flow and trust boundaries, especially if the URL points to private, sensitive, or user-supplied media.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.