ClawHub
Back to skill

Security audit

Voice Recognition

Security checks for vulnerabilities and agentic risk

Overview

This is a local Whisper transcription helper with some documentation and persistence caveats, but I did not find hidden exfiltration, destructive behavior, or unrelated capabilities.

Before installing, confirm the script path is correct for your machine, understand that transcripts are saved as plaintext beside the audio file, and only add the ~/.zshrc alias if you want that command to persist across future shell sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The description is mostly aligned on the main purpose: local speech-to-text via Whisper CLI, including translation support. However, there are material accuracy issues. First, the claimed summarization capability suggests a real summarization feature, but the implementation merely returns the original text if short or truncates the beginning and end of the transcript if long. Second, the description claims support for Chinese, English, and 100+ languages, but the main transcribe() function only explicitly handles Chinese and otherwise forces English for the --language flag; only transcribe_auto() omits the language parameter for auto-detection, and the CLI path may pass language='auto' into transcribe(), which still maps to English. So multilingual support is overstated and partially inconsistent with behavior. No hidden malicious or unrelated capabilities were observed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs users to invoke a local Python script and shell commands, but it does not declare any explicit tool scope such as shell or file access permissions. This creates an under-specified trust boundary: an agent or user may execute file-reading and shell-capable behavior without clear consent or review, which is risky because the referenced script lives outside the skill package and could perform unexpected actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The instruction to add a persistent alias to ~/.zshrc modifies the user's shell startup configuration, creating a lasting change that survives the current session. While the alias itself is not overtly malicious, persistence mechanisms are security-relevant because they normalize execution of a hard-coded script path from future shells and can mask later script changes or path misuse.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

python3 /Users/liyi/.openclaw/workspace/scripts/voice识别_升级版.py audio.m4a --summarize

text

### Quick Command (add to ~/.zshrc)

```bash
alias voice="python3 /Users/liyi/.openclaw/workspace/scripts/voice识别_升级版.py"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The main transcription function sets language="zh" by default, and the CLI examples also frame Chinese as the default behavior. This can violate language/locale policy expectations because the tool imposes a specific language choice unless the user explicitly overrides it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code writes transcript output next to the input audio without warning, which can expose highly sensitive spoken content as plaintext files in shared or synced directories. Because speech transcripts often contain personal, financial, or confidential business information, silent persistence materially increases confidentiality risk even though processing is local.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/voice识别_升级版.py (reported line 59)May include surrounding context.

python
]
    
    # 执行识别
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    output_file = audio_path.with_suffix(".txt")
    transcript = ""

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/voice识别_升级版.py (reported line 97)May include surrounding context.

python
"--output_dir", str(audio_path.parent)
    ]
    
    subprocess.run(cmd, capture_output=True, text=True)
    
    output_file = audio_path.with_suffix(".txt")
    if output_file.exists():

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/voice识别_升级版.py (reported line 117)May include surrounding context.

python
def quick_check():
    """检查 Whisper 是否可用"""
    result = subprocess.run([WHISPER_CMD, "--help"], capture_output=True, text=True)
    return "whisper" in result.stdout.lower()

# CLI 接口

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The manifest describes a voice-recognition skill with local Whisper support, but does not explicitly state that it executes a local command-line program. Spawning subprocesses is a stronger capability than simple library-based text processing and may matter for review even if Whisper CLI is the intended backend.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill presents itself as local speech-to-text but also causes persistent transcription files to be written to disk as a side effect. For sensitive audio, this can leave readable plaintext transcripts in the source directory, increasing exposure to other local users, backup systems, or later unintended disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.