ClawHub
Back to skill

Security audit

Voice Recognition

Security checks for vulnerabilities and agentic risk

Overview

This is a local Whisper transcription helper with some documentation and persistence caveats, but I did not find hidden exfiltration, destructive behavior, or unrelated capabilities.

Before installing, confirm the script path is correct for your machine, understand that transcripts are saved as plaintext beside the audio file, and only add the ~/.zshrc alias if you want that command to persist across future shell sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The description is mostly aligned on the main purpose: local speech-to-text via Whisper CLI, including translation support. However, there are material accuracy issues. First, the claimed summarization capability suggests a real summarization feature, but the implementation merely returns the original text if short or truncates the beginning and end of the transcript if long. Second, the description claims support for Chinese, English, and 100+ languages, but the main `transcribe()` function only explicitly handles Chinese and otherwise forces English for the `--language` flag; only `transcribe_auto()` omits the language parameter for auto-detection, and the CLI path may pass `language='auto'` into `transcribe()`, which still maps to English. So multilingual support is overstated and partially inconsistent with behavior. No hidden malicious or unrelated capabilities were observed.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs users to invoke a local Python script and shell commands, but it does not declare any explicit tool scope such as shell or file access permissions. This creates an under-specified trust boundary: an agent or user may execute file-reading and shell-capable behavior without clear consent or review, which is risky because the referenced script lives outside the skill package and could perform unexpected actions.

Session Persistence

Medium
Category
Rogue Agent
Content
python3 /Users/liyi/.openclaw/workspace/scripts/voice识别_升级版.py audio.m4a --summarize
```

### Quick Command (add to ~/.zshrc)

```bash
alias voice="python3 /Users/liyi/.openclaw/workspace/scripts/voice识别_升级版.py"
Confidence
90% confidence
Finding
The instruction to add a persistent alias to ~/.zshrc modifies the user's shell startup configuration, creating a lasting change that survives the current session. While the alias itself is not overtly malicious, persistence mechanisms are security-relevant because they normalize execution of a hard-coded script path from future shells and can mask later script changes or path misuse.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The main transcription function sets `language="zh"` by default, and the CLI examples also frame Chinese as the default behavior. This can violate language/locale policy expectations because the tool imposes a specific language choice unless the user explicitly overrides it.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code writes transcript output next to the input audio without warning, which can expose highly sensitive spoken content as plaintext files in shared or synced directories. Because speech transcripts often contain personal, financial, or confidential business information, silent persistence materially increases confidentiality risk even though processing is local.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
]
    
    # 执行识别
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    output_file = audio_path.with_suffix(".txt")
    transcript = ""
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"--output_dir", str(audio_path.parent)
    ]
    
    subprocess.run(cmd, capture_output=True, text=True)
    
    output_file = audio_path.with_suffix(".txt")
    if output_file.exists():
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def quick_check():
    """检查 Whisper 是否可用"""
    result = subprocess.run([WHISPER_CMD, "--help"], capture_output=True, text=True)
    return "whisper" in result.stdout.lower()

# CLI 接口
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Low
Confidence
75% confidence
Finding
The manifest describes a voice-recognition skill with local Whisper support, but does not explicitly state that it executes a local command-line program. Spawning subprocesses is a stronger capability than simple library-based text processing and may matter for review even if Whisper CLI is the intended backend.

Description-Behavior Mismatch

Low
Confidence
82% confidence
Finding
The skill presents itself as local speech-to-text but also causes persistent transcription files to be written to disk as a side effect. For sensitive audio, this can leave readable plaintext transcripts in the source directory, increasing exposure to other local users, backup systems, or later unintended disclosure.

Static analysis

No suspicious patterns detected.