ClawHub
Back to skill

Security audit

Audio PTBR

Security checks for vulnerabilities and agentic risk

Overview

This voice skill has a coherent purpose, but it needs Review because its shell hook and installer grant broad execution authority without enough scoping or verification.

Review before installing. Use a container or dedicated virtual environment, do not run the installer with elevated privileges unless you accept host package changes, verify or pin the Piper and model downloads, and fix the shell hook to pass arguments without shell interpolation. Only set ANTHROPIC_API_KEY if you are comfortable sending transcribed speech to Anthropic.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:17
Finding

Shell Injection Through Unescaped Skill Hook Variables

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17-23
Vulnerability Type: Command injection through shell-based template interpolation
Risk Level: High

Vulnerable Code

yaml
hooks:
  - event: "message.audio.receive"
    action: "bash process.sh \"{{MediaPath}}\" \"{{Target}}\" \"{{MessageID}}\""
triggers:
  - command: "/voz"
    description: "Configurar voz ou processar áudio manualmente"
    action: "bash process.sh \"{{args}}\""

Technical Analysis

Dynamic hook values are interpolated directly into a shell command string. Quoting a template expression with double quotes does not make it safe if the substituted value itself can contain a double quote, command substitution, a newline, or shell control operators.

The /voz trigger is especially exposed because {{args}} can contain directly user-controlled message content. Unless OpenClaw guarantees context-aware shell escaping before expansion, an attacker can terminate the quoted argument and introduce additional shell syntax.

Although process.sh generally passes its arguments safely to subprocesses, that protection occurs only after the shell has parsed the hook action. Injection therefore happens before process.sh receives the arguments.

Attack Path

  1. An attacker invokes /voz with content containing a closing quote and shell control syntax.
  2. OpenClaw substitutes the content into the action string.
  3. The generated action is passed to a shell for parsing.
  4. The injected syntax escapes the intended argument and starts an additional command.
  5. That command executes with the operating-system identity and environment of the OpenClaw gateway or Agent process.

The same issue may be reachable through MediaPath, Target, or MessageID if any upstream integration permits attacker-controlled characters in those fields.

Impact Assessment

Successful exploitation permits arbitrary command execution with the ...[truncated 363 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace string-based shell actions with an API that accepts an executable and argument array without invoking a shell.
  • Use a fixed wrapper entry point and pass dynamic values through stdin, a structured JSON file, or separately populated environment variables.
  • If the host only supports shell action strings, require and document a host-provided shell-escaping primitive rather than inserting raw template values.
  • Apply strict allowlists:
    • Require MediaPath to resolve beneath an approved media directory.
    • Restrict Target and MessageID to their documented identifier character sets.
    • Parse /voz as a voice command and accept only known values such as jeff, cadu, faber, or miro.
  • Add integration tests with quotes, command substitutions, semicolons, newlines, and shell metacharacters to confirm they are treated exclusively as data.

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:27
Finding

Unverified Remote Piper Executable Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: install.sh:27-36 and install.sh:87-98
Vulnerability Type: Remote executable retrieval without cryptographic integrity verification
Risk Level: High

Vulnerable Code

bash
# Set Piper download URL based on architecture
case $ARCH in
  arm64|aarch64)
    PIPER_URL="https://github.com/rhasspy/piper/releases/download/v1.2.0/piper_arm64.tar.gz"
    PIPER_FILE="piper_arm64.tar.gz"
    echo -e "${GREEN}✓ ARM64 detected (Raspberry Pi, Apple Silicon)${NC}"
    ;;
  x86_64|amd64)
    PIPER_URL="https://github.com/rhasspy/piper/releases/download/v1.2.0/piper_x86_64.tar.gz"
    PIPER_FILE="piper_x86_64.tar.gz"
    echo -e "${GREEN}✓ x86_64 detected (Intel/AMD)${NC}"
    ;;
bash
echo -e "${BLUE}[4/6] Downloading Piper TTS...${NC}"

if [ -f "$PIPER_DIR/piper/piper" ]; then
  echo -e "${GREEN}✓ Piper already installed${NC}"
else
  echo "  Downloading from: $PIPER_URL"
  cd "$PIPER_DIR"
  wget -q "$PIPER_URL" -O "$PIPER_FILE"
  tar xzf "$PIPER_FILE"
  rm "$PIPER_FILE"
  chmod +x "$PIPER_DIR/piper/piper"
  echo -e "${GREEN}✓ Piper installed successfully${NC}"
fi

Technical Analysis

The installer downloads a native Piper archive, extracts it, and marks the contained binary executable without checking a publisher signature or an expected cryptographic digest. HTTPS protects the network connection but does not independently establish that the received artifact is the exact artifact reviewed by the Skill publisher.

Downloading Piper is necessary for the declared local text-to-speech functionality, and the URL points to the declared Rhasspy GitHub release rather than an unrelated paste service. The behavior is therefore functionally justified. The unsafe aspect is the absence of artifact integrity verification before execution.

The binary is subsequently executed by synthesize_universal.py during normal synthesis and by `health_ch ...[truncated 1048 chars]

Remediation
View remediation

Remediation Suggestions

  • Publish expected SHA-256 or stronger digests for every supported Piper archive directly in the Skill package.
  • After downloading, verify the archive using sha256sum -c or an equivalent tool and abort before extraction on any mismatch.
  • Where upstream signatures are available, verify them against a pinned publisher key.
  • Download into a secure temporary directory and extract only after verification.
  • Validate archive members before extraction to reject absolute paths, .. traversal, links escaping the destination, and unexpected files.
  • Pin a specific immutable upstream release asset and document its provenance.
  • Execute the binary with the minimum possible permissions and without unnecessary secrets in its environment.

T08 · Insecure Dependencies

Warning
Location
install.sh:103
Finding

Voice Models Are Retrieved From Mutable Sources Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: install.sh:103-122
Vulnerability Type: Unverified third-party model dependency retrieval
Risk Level: Medium

Vulnerable Code

bash
# Voice models with their URLs
declare -A VOICES=(
  ["pt_BR-jeff-medium.onnx"]="https://huggingface.co/rhasspy/piper-voices/resolve/main/pt/pt_BR/jeff/medium/pt_BR-jeff-medium.onnx"
  ["pt_BR-jeff-medium.onnx.json"]="https://huggingface.co/rhasspy/piper-voices/resolve/main/pt/pt_BR/jeff/medium/pt_BR-jeff-medium.onnx.json"
  ["pt_BR-cadu-medium.onnx"]="https://huggingface.co/rhasspy/piper-voices/resolve/main/pt/pt_BR/cadu/medium/pt_BR-cadu-medium.onnx"
  ["pt_BR-cadu-medium.onnx.json"]="https://huggingface.co/rhasspy/piper-voices/resolve/main/pt/pt_BR/cadu/medium/pt_BR-cadu-medium.onnx.json"
  ["pt_BR-faber-medium.onnx"]="https://huggingface.co/rhasspy/piper-voices/resolve/main/pt/pt_BR/faber/medium/pt_BR-faber-medium.onnx"
  ["pt_BR-faber-medium.onnx.json"]="https://huggingface.co/rhasspy/piper-voices/resolve/main/pt/pt_BR/faber/medium/pt_BR-faber-medium.onnx.json"
  ["pt_BR-miro-high.onnx"]="https://huggingface.co/TarcisoAmorim/piper-pt_BR-miro-high/resolve/main/model.onnx"
  ["pt_BR-miro-high.onnx.json"]="https://huggingface.co/TarcisoAmorim/piper-pt_BR-miro-high/resolve/main/config.json"
)

cd "$VOICES_DIR"
for voice_file in "${!VOICES[@]}"; do
  if [ ! -f "$voice_file" ]; then
    echo "  Downloading $voice_file..."
    wget -q "${VOICES[$voice_file]}" -O "$voice_file" || echo -e "${YELLOW}⚠ Failed to download $voice_file${NC}"
  fi
done

Technical Analysis

The voice artifacts are downloaded from URLs that resolve the mutable main branch rather than an immutable repository commit. No checksum or signature is validated. This means the content installed in the future can differ from the content reviewed today while retaining the same URL.

Three voices come from the declared Rhasspy voice repository, while ...[truncated 1412 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace every /resolve/main/ URL with a URL pinned to an immutable Hugging Face commit revision.
  • Store and verify a cryptographic digest for each ONNX and JSON artifact.
  • Abort installation when any required download fails or has an unexpected digest; do not print a general success message after partial failure.
  • Treat community models as optional and request explicit user consent before installing them.
  • Validate downloaded JSON against the expected Piper configuration schema and enforce reasonable size limits.
  • Run model processing with resource limits and a restricted environment where practical.
  • Maintain a documented bill of materials containing source repository, revision, digest, license, and model size.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
install.sh:62
Finding

Installer Performs Unconfirmed System-Wide and Unpinned Dependency Changes

Content
View full analysis

Vulnerability Details

File Location: install.sh:62-80
Vulnerability Type: Excessive installation privileges and unpinned global dependency installation
Risk Level: Medium

Vulnerable Code

bash
# Check for required system tools
for cmd in python3 pip ffmpeg; do
  if ! command -v $cmd &> /dev/null; then
    echo -e "${YELLOW}⚠ $cmd not found. Installing...${NC}"
    if [[ "$OS" == "Linux" ]]; then
      sudo apt-get update && sudo apt-get install -y $cmd
    elif [[ "$OS" == "Darwin" ]]; then
      brew install $cmd
    fi
  fi
done

# Install Python dependencies
python3 -m pip install --upgrade pip setuptools wheel > /dev/null 2>&1
python3 -m pip install -q transformers torch torchaudio anthropic

if [ -d "$VENV" ]; then
  source "$VENV/bin/activate"
  python -m pip install -q transformers torch torchaudio anthropic
  deactivate
fi

Technical Analysis

The advertised one-command installer automatically invokes sudo apt-get when dependencies are missing and uses -y, eliminating package-manager confirmation. It also upgrades packaging tools and installs Python dependencies into the active Python environment before optionally installing them into an existing virtual environment.

These Python installations do not use the versions declared in requirements.txt; therefore, the actual dependency set is determined by repository state at installation time. The virtual environment is only used if it already exists, despite VENV being configured by the script.

Installing FFmpeg and Python is related to the declared functionality, but automatically modifying the host package database and global Python environment exceeds the minimum privileges needed by the Skill. A safer installer can detect missing system dependencies and request explicit user action while keeping Python packages isolated.

Attack Path

  1. A user follows the documentation and ...[truncated 1043 chars]
Remediation
View remediation

Remediation Suggestions

  • Create a dedicated virtual environment unconditionally, for example under ~/.openclaw/workspace/venv, and install all Python dependencies only into that environment.
  • Install from a complete lock file with exact versions and hashes. Do not use unbounded package names in the production installer.
  • Do not silently upgrade pip, setuptools, or wheel; pin their versions if an upgrade is required.
  • Detect missing system packages and display exact manual installation commands instead of automatically invoking sudo.
  • If automatic OS package installation remains available, make it an explicit opt-in flag and show the complete command before requesting confirmation.
  • Use correctly mapped package names rather than assuming command names always equal operating-system package names.
  • Avoid installing the optional Anthropic client unless the user enables Claude integration.

T09 · Insecure Skill Coding Practices

Warning
Location
synthesize_universal.py:145
Finding

Predictable Shared Temporary Audio Paths Permit Symlink and Concurrency Attacks

Content
View full analysis

Vulnerability Details

File Location: synthesize_universal.py:145-153 and synthesize_universal.py:187-196
Vulnerability Type: Insecure predictable temporary-file creation
Risk Level: Medium

Vulnerable Code

python
# Set output path
if output_path is None:
    tmpdir = Path(os.environ.get('TMPDIR', '/tmp'))
    output_path = tmpdir / 'autoreply_out.ogg'
else:
    output_path = Path(output_path)

output_path.parent.mkdir(parents=True, exist_ok=True)

# Temporary WAV file
temp_wav = output_path.parent / f"{output_path.stem}_temp.wav"
python
subprocess.run(
    [
        "ffmpeg",
        "-i", str(temp_wav),
        "-c:a", "libopus",
        "-b:a", "32k",
        "-y",  # Overwrite
        str(output_path)
    ],
    capture_output=True,
    check=True,
    timeout=timeout
)

Technical Analysis

Every default synthesis operation uses /tmp/autoreply_out.ogg and /tmp/autoreply_out_temp.wav, or the corresponding paths under a user-controlled TMPDIR. These names are predictable and shared across requests.

The code does not securely create the files with exclusive semantics and does not reject symbolic links. FFmpeg receives -y, explicitly allowing it to overwrite the destination. Multiple concurrent synthesis requests also operate on the same files, allowing one request to replace or consume another request’s audio.

synthesize_to_bytes uses NamedTemporaryFile for its OGG destination, but normal CLI execution calls synthesize_to_file without an output path and therefore remains vulnerable.

Attack Path

Local symlink attack:

  1. A local attacker able to write to the temporary directory predicts /tmp/autoreply_out.ogg.
  2. The attacker creates that path as a symbolic link to a file writable by the victim account.
  3. The Skill performs synthesis.
  4. FFmpeg follows the path while processing -y and overwrites the linked desti ...[truncated 752 chars]
Remediation
View remediation

Remediation Suggestions

  • Create a unique private temporary directory for every synthesis operation using tempfile.TemporaryDirectory.
  • Create both WAV and OGG files with unpredictable names and restrictive permissions.
  • Avoid reopening attacker-replaceable paths after secure creation. Where practical, use file descriptors or verify inode identity before use.
  • Reject symbolic links and ensure temporary paths remain inside the newly created private directory.
  • Remove -y unless overwriting a securely created per-request file is explicitly required.
  • Return a unique output path for each message and delete it only after the delivery operation has completed.
  • Add concurrency tests proving that simultaneous requests cannot read, replace, or delete each other’s files.

other

Note
Location
AudioPTInterface.jsx:16
Finding

Browser Microphone Stream Is Not Released After Recording Stops

Content
View full analysis

Vulnerability Details

File Location: AudioPTInterface.jsx:16-47
Vulnerability Type: Microphone resource and privacy lifecycle weakness
Risk Level: Low

Vulnerable Code

javascript
const startRecording = async () => {
  try {
    const stream = await navigator.mediaDevices.getUserMedia({ audio: true });
    const mediaRecorder = new MediaRecorder(stream);
    mediaRecorderRef.current = mediaRecorder;
    audioChunksRef.current = [];

    mediaRecorder.ondataavailable = (event) => {
      audioChunksRef.current.push(event.data);
    };

    mediaRecorder.onstop = () => {
      const audioBlob = new Blob(audioChunksRef.current, { type: 'audio/wav' });
      setAudioFile(audioBlob);
    };

    mediaRecorder.start();
    setIsRecording(true);
  } catch (error) {
    alert('Erro ao acessar microfone: ' + error.message);
  }
};

const stopRecording = () => {
  if (mediaRecorderRef.current) {
    mediaRecorderRef.current.stop();
    setIsRecording(false);
  }
};

Technical Analysis

Calling MediaRecorder.stop() stops the recorder but does not necessarily stop the underlying MediaStreamTrack. The component neither stores the stream in a reference nor calls track.stop() when recording ends, an error occurs, or the component unmounts.

Consequently, the browser may continue to show an active microphone capture session and retain the audio source until the stream is garbage-collected or the page is closed. The inspected component does not transmit recorded data over the network; its processing function currently uses simulated responses. The issue is therefore lifecycle and privacy hygiene rather than confirmed exfiltration.

Attack Path

  1. The user grants microphone permission and starts recording.
  2. The component obtains an active audio stream.
  3. The user presses the stop button.
  4. The recorder stops, but the stream’s audio track remains ...[truncated 464 chars]
Remediation
View remediation

Remediation Suggestions

  • Store the acquired MediaStream in a React ref.
  • When recording stops, call stream.getTracks().forEach(track => track.stop()).
  • Perform the same cleanup after recorder errors and when the component unmounts.
  • Clear mediaRecorderRef and the stream reference after cleanup.
  • Disable duplicate start operations while a stream is active.
  • Present an explicit recording indicator tied to the actual track state rather than only the React isRecording value.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (63)

Known Vulnerable Dependency: torch==2.1.2 — 16 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution); CVE-2024-31580 (PyTorch heap buffer overflow vulnerability) +13 more

Critical
Category
Supply Chain
Confidence
98% confidence
Finding

torch==2.1.2 is flagged with multiple known advisories, including issues that can lead to denial of service, memory corruption, and possible remote code execution in unsafe deserialization paths. Because ML/audio skills commonly load model files and process untrusted data, the presence of a known-vulnerable PyTorch version materially increases risk in this context.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 119)May include surrounding context.

Piper not found

bash
# Reinstall Piper
rm -rf ~/.openclaw/workspace/piper
bash install.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 187)May include surrounding context.

Piper not found

bash
# Reinstall Piper
rm -rf ~/.openclaw/workspace/piper
bash install.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 188)May include surrounding context.

Piper not found

bash
# Reinstall Piper
rm -rf ~/.openclaw/workspace/piper
bash install.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 119)May include surrounding context.

Piper not found

bash
# Reinstall Piper
rm -rf ~/.openclaw/workspace/piper
bash install.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 188)May include surrounding context.

Piper not found

bash
# Reinstall Piper
rm -rf ~/.openclaw/workspace/piper
bash install.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 187)May include surrounding context.

Uninstall completely

bash
rm -rf ~/.openclaw/skills/audio-ptbr-autoreply
rm -rf ~/.openclaw/workspace/piper
rm ~/.openclaw/workspace/.audio_pt_voice_config

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 189)May include surrounding context.

bash
rm -rf ~/.openclaw/skills/audio-ptbr-autoreply
rm -rf ~/.openclaw/workspace/piper
rm ~/.openclaw/workspace/.audio_pt_voice_config

📝 File Structure

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SECURITY_REVIEW_RESPONSE.md (reported line 79)May include surrounding context.

└─ Show responses

text

**Fix - Update SKILL.md:**
```markdown
## Default Behavior (OpenClaw)
- Audio in → Silent processing → Audio out

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · install.sh (reported line 67)May include surrounding context.

sh
if ! command -v $cmd &> /dev/null; then
    echo -e "${YELLOW}⚠ $cmd not found. Installing...${NC}"
    if [[ "$OS" == "Linux" ]]; then
      sudo apt-get update && sudo apt-get install -y $cmd
    elif [[ "$OS" == "Darwin" ]]; then
      brew install $cmd
    fi

Known Vulnerable Dependency: transformers==4.36.2 — 16 advisory(ies): CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2024-3568 (Transformers Deserialization of Untrusted Data vulnerability) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

transformers==4.36.2 is associated with multiple published advisories, including remote code execution, deserialization, and ReDoS concerns. This is especially relevant for an audio/ML agent skill that may fetch, parse, or load model/tokenizer/processor assets, making exploitation more plausible than in a non-ML project.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description explicitly states that transcription and responses are in Brazilian Portuguese, which imposes a locale constraint in the user-facing behavior. The file does not present this as an optional setting or justified region-specific limitation, so it fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The tip instructs users to speak naturally in Brazilian Portuguese and describes the system's support for slang and accents only in that locale. Because no language choice or opt-in is provided elsewhere in the component, this is a natural-language locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The guide states in Portuguese that the skill now works across environments, and multiple examples imply fixed Portuguese/pt-BR behavior, including returning language as "pt-BR". There is no indication that users can opt into another language or that the locale restriction is explicitly justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CROSS_PLATFORM_GUIDE.md (reported line 92)May include surrounding context.

Claude Desktop (Novo!)

bash
# 1. Copiar para um local acessível
mkdir -p ~/.claude-audio-pt
cp -r audio-ptbr-autoreply/* ~/.claude-audio-pt/

# 2. Instalar dependências

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documented REST API example accepts uploaded audio, writes it to a fixed temporary filename, and returns synthesized audio without any discussion of data handling, retention, or cleanup. In practice this can lead to privacy exposure, accidental persistence of sensitive user audio/text, filename collisions between requests, and unsafe multi-user behavior if copied directly into production.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 12)May include surrounding context.

md
# Backup current skill
mv ~/.openclaw/skills/audio-ptbr-autoreply ~/.openclaw/skills/audio-ptbr-autoreply.backup

# Create new skill structure
mkdir -p ~/.openclaw/skills/audio-ptbr-autoreply/scripts

# Copy these files to the skill directory:

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 21)May include surrounding context.

md
cp requirements.txt ~/.openclaw/skills/audio-ptbr-autoreply/
cp QUICKSTART.md ~/.openclaw/skills/audio-ptbr-autoreply/
cp README_IMPROVED.md ~/.openclaw/skills/audio-ptbr-autoreply/README.md
cp SKILL_IMPROVED.md ~/.openclaw/skills/audio-ptbr-autoreply/SKILL.md

# Copy script files
cp claude_adapter.py ~/.openclaw/skills/audio-ptbr-autoreply/scripts/

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 54)May include surrounding context.

md
cp requirements.txt ~/.openclaw/skills/audio-ptbr-autoreply/
cp QUICKSTART.md ~/.openclaw/skills/audio-ptbr-autoreply/
cp README_IMPROVED.md ~/.openclaw/skills/audio-ptbr-autoreply/README.md
cp SKILL_IMPROVED.md ~/.openclaw/skills/audio-ptbr-autoreply/SKILL.md

# Copy script files
cp claude_adapter.py ~/.openclaw/skills/audio-ptbr-autoreply/scripts/

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file includes a credential-setting command for ANTHROPIC_API_KEY, which involves sensitive secret handling. The guide provides no user-facing warning about protecting the key, avoiding shell history exposure, or limiting where it is stored, so the credential-related behavior lacks disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 212)May include surrounding context.

~/.openclaw/skills/audio-ptbr-autoreply.backup

text

2. **Copy new files (don't overwrite everything)**
```bash
cd ~/.openclaw/skills/audio-ptbr-autoreply
cp /downloaded/install.sh .

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Claude integration section encourages setting an API key and states that voice messages will be processed by Claude, but it does not clearly warn that user audio/transcripts may be transmitted to a third-party service. This can lead to unintentional disclosure of sensitive personal or business information, especially because voice messages often contain high-risk data and users may assume processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README frames the skill as a 'Brazilian Portuguese voice transcription + AI responses' interface and later emphasizes Portuguese-oriented behavior, but it does not clearly present this language constraint as an opt-in choice at activation time. This can violate language/locale policy expectations when a skill imposes a specific locale rather than offering or confirming user preference.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README advertises optional Claude integration but does not clearly warn users that, when enabled, message content derived from their audio may be transmitted to Anthropic for processing. In a voice-processing skill, this omission is security- and privacy-relevant because users may assume all processing is local and unknowingly expose sensitive speech content to a third party.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_REVIEW_RESPONSE.md (reported line 98)May include surrounding context.

md
**Finding:**
- Downloads ~500MB of torch/transformers
- Uses `sudo apt-get`/`brew` without interactive confirmation
- Global pip installs can break system Python
- No virtualenv by default

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README.md:119