ClawHub
Back to skill

Security audit

iFlytek ASR - 讯飞语音转文字

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but its YouTube downloader weakens HTTPS safety and can be steered to non-YouTube hosts, so it should be reviewed before installation.

Install only if you are comfortable uploading selected audio or downloaded YouTube media to iFlytek and storing iFlytek API credentials in a local .env file. Before use, remove the downloader certificate-bypass option, tighten URL validation to canonical YouTube hosts, and prefer pinned dependencies in an isolated virtual environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download_audio.py:83
Finding

TLS Certificate Verification Disabled in YouTube Downloader

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/download_audio.py:17
Finding

Insufficient YouTube URL Validation Permits Requests to Attacker-Controlled Hosts

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Open-Ended Third-Party Dependencies Are Installed Without Integrity Pinning

Content
View full analysis
=2024.1.0 requests>=2.31.0 python-dotenv>=1.0.0 ``` `install.sh:15-23`: ```bash # 安装依赖 echo "" echo "📦 安装 Python 依赖..." pip3 install -r requirements.txt if [ $? -ne 0 ]; then echo "❌ 依赖安装失败" exit 1 fi ``` The documentation also directs users to install open-ended packages directly: ```bash pip3 install yt-dlp requests python-dotenv ``` ### Technical Analysis The requirement entries specify minimum versions but no upper bounds, exact versions, or artifact hashes. A future installation may therefore resolve to any newer package release available from the configured Python package index. Package installation can execute package build or installation logic. After installation, the scripts import `requests` and `python-dotenv`, and locate and execute the `yt-dlp` program. Consequently, a compromised future release, compromised package-maintainer account, malicious package-index response, or unsafe alternate index could introduce code that executes with the installing user's privileges. No evidence was found that the currently named packages are typosquatted or malicious. The vulnerability is the absence of reproducible version and integrity controls, not a confirmed malicious dependency. The installer also invokes ambient `pip3` rather than creating an isolated virtual environment, increasing the chance of modifying a global or user-wide Python environment. ### Attack Path 1. An attacker compromises a dependency maintainer, release account, package-index path, or configured alternate package repository. 2. A malicious version newer than the stated minimum is published or served. 3. A user runs `install.sh` or follows the documented `p ...[truncated 1117 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (62)

Tainted flow: 'params' from os.getenv (line 137, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/speech_to_text.py (reported line 161)May include surrounding context.

python
with open(file_path, "rb") as f:
        file_data = f.read()

    resp = requests.post(URL_UPLOAD, params=params, headers=headers, data=file_data)
    result = resp.json()
    print(f"[调试] 上传响应: {result}")

Tainted flow: 'params' from os.getenv (line 185, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/speech_to_text.py (reported line 201)May include surrounding context.

python
"signature": signature,
        }

        resp = requests.post(URL_GET_RESULT, params=params, headers=headers)
        result = resp.json()

        if result.get("code") != "000000":

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DISTRIBUTION.md (reported line 10)May include surrounding context.

bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"

生成的 iflytek-asr-skill.zip 就可以分享给别人了！

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 36)May include surrounding context.

sh
```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package.sh (reported line 28)May include surrounding context.

sh
```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/speech_to_text.py (reported line 31)May include surrounding context.

python
```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/speech_to_text.py (reported line 32)May include surrounding context.

python
```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/speech_to_text.py (reported line 35)May include surrounding context.

python
```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · QUICKSTART.md (reported line 26)May include surrounding context.

bash
# 复制模板文件
cp .env.example .env

# 编辑 .env 文件，粘贴你的凭证
nano .env  # 或用任何文本编辑器

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

bash
# 复制模板文件
cp .env.example .env

# 编辑 .env 文件，粘贴你的凭证
nano .env  # 或用任何文本编辑器

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DISTRIBUTION.md (reported line 60)May include surrounding context.

md
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · QUICKSTART.md (reported line 28)May include surrounding context.

md
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · QUICKSTART.md (reported line 29)May include surrounding context.

md
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

md
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 29)May include surrounding context.

sh
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 31)May include surrounding context.

sh
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 32)May include surrounding context.

sh
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 34)May include surrounding context.

sh
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 36)May include surrounding context.

sh
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 39)May include surrounding context.

sh
# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"