ClawHub
Back to skill

Security audit

voice

Security checks for vulnerabilities and agentic risk

Overview

This voice skill largely matches its stated purpose, but it needs Review because sensitive Discord speech and generated text can be routed through a hardcoded SkillBoss service while provider labels and privacy notices understate that.

Review before installing. Use it only in Discord channels where participants understand speech may be recorded, transcribed, sent to external services, processed by the agent, and spoken back. Treat SkillBoss/HeyBoss as a data processor even when selecting providers labeled OpenAI, Deepgram, or ElevenLabs; prefer local/offline providers where needed, set allowedUsers, avoid autoJoin unless intentional, and run it on a patched OpenClaw host with current dependencies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The class is documented as supporting configurable OpenAI transcription models, but the outbound request never includes the selected model and instead sends a generic STT request to a third-party hub. This is a security-relevant integrity issue because operators may believe they are using a specific provider/model and associated data-handling guarantees when audio is actually routed differently.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The provider is labeled and configured as Deepgram, but the code sends audio and credentials to the SkillBoss API Hub instead of directly to Deepgram. This can mislead users about where sensitive voice data is transmitted and what vendor trust boundary applies, creating an undisclosed data-exfiltration path.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation describes voice capture, transcription, agent processing, and speech playback, but it does not clearly warn users that spoken audio may be recorded and transmitted to external STT/TTS providers by default. In a voice-enabled Discord setting, this creates a real privacy and consent risk because channel participants may not realize their speech is being processed by third parties or retained under those providers' policies.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The manifest clearly advertises real-time voice conversations and supports multiple cloud STT/TTS providers, but it does not include any user-facing disclosure that spoken audio and derived transcripts may be transmitted to third-party services. In a voice/Discord context, this increases privacy and consent risk because users in a channel may not realize their speech is being captured, transcribed, and sent off-platform for processing.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The plugin captures Discord voice transcripts and routes them to external providers for speech-to-text, LLM processing, and text-to-speech, but this file does not enforce any explicit user-facing consent or disclosure before that data leaves Discord. In a voice-chat context, users may reasonably assume they are speaking only within the channel; silently forwarding their speech to third-party AI services creates a real privacy and compliance risk, especially for bystanders in joined channels.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The manifest explicitly supports real-time voice conversations and multiple remote STT/TTS providers, including OpenAI, ElevenLabs, and Deepgram, but it does not disclose that user audio and transcripts may be sent to third-party services. In a voice-processing plugin, this omission is security- and privacy-relevant because users or operators may unknowingly expose sensitive spoken content to external vendors.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This code streams raw audio to Deepgram over a WebSocket, but there is no evidence in this file of any consent gate, disclosure, or policy enforcement before user speech is transmitted off-platform. In a voice/Discord context, sending potentially sensitive spoken content to a third-party processor without explicit user notice can create privacy and compliance risk, especially if the skill is deployed in shared or multi-user environments.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code captures Discord voice audio and transcribes it through configurable third-party STT providers such as Deepgram, OpenAI, local/remote Wyoming, and fallback providers, but this file shows no user-facing notice, consent gate, or channel-level disclosure before sending speech off-box. In a voice-chat context, users may reasonably not expect their live speech to be forwarded to external services, creating a real privacy and compliance risk even if this is intended functionality.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The bot sends generated response text to external TTS providers without any visible disclosure in this component. This is less sensitive than raw user audio, but responses may still contain user-derived or confidential content from transcripts or agent output, so forwarding text to third-party providers can leak conversation data.

External Transmission

Medium
Category
Data Exfiltration
Content
async synthesize(text: string): Promise<TTSResult> {
    // TTS via SkillBoss API Hub /v1/pilot — auto-routes to best TTS model
    const response = await fetch("https://api.heybossai.com/v1/pilot", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
Confidence
88% confidence
Finding
This code transmits arbitrary input text to a third-party service (api.heybossai.com) for synthesis, which can expose sensitive user content outside the local trust boundary. In a voice/agent skill context, users may submit secrets, personal data, or private messages that are then sent to an external provider without any visible consent gate, data-classification check, or allowlist policy.

External Transmission

Medium
Category
Data Exfiltration
Content
async synthesize(text: string): Promise<TTSResult> {
    // TTS via SkillBoss API Hub /v1/pilot — auto-routes to best TTS model
    const response = await fetch("https://api.heybossai.com/v1/pilot", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
Confidence
88% confidence
Finding
This provider also sends user-supplied text to the external SkillBoss API Hub, creating the same data exfiltration risk across a third-party boundary. Because TTS inputs often come from chats, commands, or generated summaries, the content may include confidential or regulated data that should not leave the environment by default.

External Transmission

Medium
Category
Data Exfiltration
Content
async synthesize(text: string): Promise<TTSResult> {
    // TTS via SkillBoss API Hub /v1/pilot — auto-routes to best TTS model
    const response = await fetch("https://api.heybossai.com/v1/pilot", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
Confidence
88% confidence
Finding
This Deepgram wrapper uses the same external SkillBoss endpoint, so any supplied text is transmitted to a remote service and potentially retained or logged outside the application's control. The danger is increased in agent skills because they often process mixed-trust content, including user messages and operational data.

External Transmission

Medium
Category
Data Exfiltration
Content
async synthesize(text: string): Promise<TTSResult> {
    // TTS via SkillBoss API Hub /v1/pilot — auto-routes to best TTS model
    const response = await fetch("https://api.heybossai.com/v1/pilot", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
Confidence
88% confidence
Finding
This code transmits arbitrary input text to a third-party service (api.heybossai.com) for synthesis, which can expose sensitive user content outside the local trust boundary. In a voice/agent skill context, users may submit secrets, personal data, or private messages that are then sent to an external provider without any visible consent gate, data-classification check, or allowlist policy.

External Transmission

Medium
Category
Data Exfiltration
Content
async synthesize(text: string): Promise<TTSResult> {
    // TTS via SkillBoss API Hub /v1/pilot — auto-routes to best TTS model
    const response = await fetch("https://api.heybossai.com/v1/pilot", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
Confidence
88% confidence
Finding
This provider also sends user-supplied text to the external SkillBoss API Hub, creating the same data exfiltration risk across a third-party boundary. Because TTS inputs often come from chats, commands, or generated summaries, the content may include confidential or regulated data that should not leave the environment by default.

External Transmission

Medium
Category
Data Exfiltration
Content
async synthesize(text: string): Promise<TTSResult> {
    // TTS via SkillBoss API Hub /v1/pilot — auto-routes to best TTS model
    const response = await fetch("https://api.heybossai.com/v1/pilot", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
Confidence
88% confidence
Finding
This Deepgram wrapper uses the same external SkillBoss endpoint, so any supplied text is transmitted to a remote service and potentially retained or logged outside the application's control. The danger is increased in agent skills because they often process mixed-trust content, including user messages and operational data.

Known Vulnerable Dependency: hono==4.11.9 — 10 advisory(ies): GHSA-26pp-8wgv-hjvm (Hono missing validation of cookie name on write path in setCookie()); GHSA-458j-xx4x-4375 (hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SS); CVE-2026-29086 (Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in) +7 more

High
Category
Supply Chain
Confidence
92% confidence
Finding
The manifest depends on hono 4.11.9, which is reported to have multiple published advisories including cookie handling and injection issues. In a voice/Discord plugin that also includes an HTTP framework dependency, vulnerable web-facing components can expose users or operators to request manipulation, injection, or session-related attacks if the package is used by the extension.

Known Vulnerable Dependency: ws==8.18.0 — 1 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure)

Low
Category
Supply Chain
Confidence
77% confidence
Finding
The manifest includes ws 8.18.0, which is flagged for an uninitialized memory disclosure issue. Because this plugin is real-time voice software and explicitly uses websocket-related functionality, a websocket library flaw is more relevant than in a purely offline tool, though the cited impact remains relatively low unless exposed to untrusted peers or data paths.

Known Vulnerable Dependency: openclaw==2025.0.0 — 10 advisory(ies): CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r) +7 more

High
Category
Supply Chain
Confidence
89% confidence
Finding
The peer dependency accepts openclaw >=2025.0.0, and the static analysis notes known high-severity advisories affecting 2025.0.0. Because this package is an extension for OpenClaw, its effective security posture depends heavily on the host platform, so deploying it against a vulnerable OpenClaw version could materially expose the whole skill environment.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.ts:156

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/streaming-tts.ts:45

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/stt.ts:37

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/tts.ts:48

File read combined with network send (possible exfiltration).

Warn
Code
suspicious.potential_exfiltration
Location
src/tts.ts:5