Transcrição e respostas em áudio em PTBR, Português Brasil - Brazillian portuguese transcription and audio answers

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:55 AM UTC
• Version: 2.1.3

Overview

The skill’s PT-BR voice assistant purpose is coherent, but it ships a malformed shell-templated `/voz` trigger and unverified executable/dependency installation paths that warrant Review before use.

Do not install this as-is in a shared or sensitive environment. The publisher should replace the `/voz` shell-string action with structured argument passing or remove the trigger, fix the malformed YAML, add integrity checks for downloaded Piper assets, and use locked dependency hashes. If you do install after review, leave ANTHROPIC_API_KEY unset for local-only responses and use a trusted private WORKSPACE path.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20

Finding

Shell Command Injection Through Templated Voice Command Arguments

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: install.sh:92

Finding

Remote Piper Executable Is Downloaded and Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install.sh:72

Finding

Python Dependencies Are Installed Without Hash-Locked Reproducibility

Content

View full analysis

=0.51.0,<1.0 ``` ### Technical Analysis The installer upgrades `pip`, `setuptools`, and `wheel` to whatever versions the package index currently resolves, without version pins or hashes. The optional Anthropic dependency permits any release from `0.51.0` up to, but excluding, `1.0`. Although the required top-level packages in `requirements.txt` are version-pinned, their files and transitive dependencies are not protected with cryptographic hashes. Consequently, installation is not fully reproducible and trusts mutable package-index resolution. Python package installation may execute build backends or other package-controlled installation logic. A compromised package release, package index, maintainer account, or dependency resolution path could therefore introduce attacker-controlled code. ### Attack Path 1. An attacker compromises a permitted package release, package maintainer account, package index, or transitive dependency. 2. A user runs `install.sh`. 3. `pip` resolves and downloads the current package artifacts because no hash-locked dependency set is enforced. 4. Package-controlled code may execute during installation or when imported by the Skill. 5. Malicious code runs with the privileges of the user p ...[truncated 740 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/synthesize_universal.py:56

Finding

Predictable Shared Temporary Files Permit Race Conditions and Cross-Invocation Output Substitution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Known Vulnerable Dependency: torch==2.1.2 — 16 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution); CVE-2024-31580 (PyTorch heap buffer overflow vulnerability) +13 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The file pins PyTorch to version 2.1.2, and the supplied finding indicates multiple published advisories affecting that version, including unsafe deserialization and memory safety issues. In an agent skill context, ML frameworks often process untrusted model files, checkpoints, or inputs, which makes dependency-level RCE, DoS, or memory corruption risks materially more dangerous rather than theoretical.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: transformers==4.36.2 — 16 advisory(ies): CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2024-3568 (Transformers Deserialization of Untrusted Data vulnerability) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The file pins transformers to version 4.36.2, and the finding reports multiple known vulnerabilities for that release, including deserialization-related issues and potential RCE/ReDoS classes of bugs. Because agent skills commonly download models, tokenizers, configs, or process attacker-controlled text inputs, a vulnerable transformers version increases the chance that malicious artifacts or crafted inputs could trigger compromise or service degradation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · health_check.py (reported line 56)May include surrounding context.

python

if VENV_PY.exists():
        try:
            result = subprocess.run(
                [str(VENV_PY), "-c", "import torch, torchaudio, transformers; print('ok')"],
                check=True,
                capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · health_check.py (reported line 68)May include surrounding context.

python

ok_all &= check("python dependencies", False, str(exc))

        try:
            result = subprocess.run(
                [str(VENV_PY), str(SCRIPT_DIR / "scripts" / "voice_config.py"), "get"],
                check=True,
                capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · health_check.py (reported line 81)May include surrounding context.

python

if os.environ.get("ANTHROPIC_API_KEY"):
        try:
            result = subprocess.run(
                [str(VENV_PY), "-c", "import anthropic; print('ok')"],
                check=True,
                capture_output=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer announces and proceeds to download PT-BR voice models specifically, and the file also defines only PT-BR voice assets. This is a natural-language locale constraint embedded in the skill behavior without any visible user choice or documented opt-in, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script can forward a media directive containing the generated audio path to an external OpenClaw session target whenever --target is supplied, and it does so silently with errors suppressed. In a skill that processes potentially sensitive audio/transcript data, this creates a real risk of unintended data disclosure or message exfiltration because the user is not explicitly warned or asked to confirm the outbound transmission.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The code can send transcripts to an external API and also execute a local model CLI, but there is no visible trust boundary, consent flow, or policy gate controlling when sensitive input is allowed to leave the host or trigger local execution. In a voice/transcript adapter, this increases data exposure and operational risk, especially if users assume processing is local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User transcript content is transmitted to Anthropic whenever the API key is present, with no notice, redaction, or consent mechanism in the code path. If transcripts contain personal, confidential, or regulated data, this can create a privacy and compliance issue rather than a memory-safe code flaw.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The embedded system instruction explicitly requires responses in Portuguese brasileiro, imposing a fixed language/locale behavior. The file does not offer user opt-in or language selection, and no region-specific justification is present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/claude_adapter.py (reported line 61)May include surrounding context.

python

def get_openclaw_response(transcript: str, timeout: int) -> str:
    try:
        result = subprocess.run(
            ["openclaw", "infer", "model", "run", "--prompt", transcript, "--json"],
            capture_output=True,
            text=True,

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The fallback response reflects up to 80 characters of the user transcript back into output, which can disclose secrets, personal data, or sensitive spoken content into logs, consoles, downstream consumers, or UI surfaces. This is especially risky because the fallback is used precisely when other providers fail, a condition that often increases logging and troubleshooting visibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The available voices are all mapped to pt_BR models, and there is no natural-language indication that output is locale-specific or that users can choose another language. This creates a locale constraint without explicit opt-in or justification, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script uses predictable filenames in the shared system temp directory and unlinks them if present before writing new output. In a multi-user environment this can clobber other users' files or interact dangerously with symlinks/hardlinks, and it also enables race conditions around file replacement.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/synthesize_universal.py (reported line 68)May include surrounding context.

python

path.unlink()

    try:
        subprocess.run(
            [str(piper_bin), "--model", str(model_path), "--output_file", str(wav_path)],
            input=text.encode("utf-8"),
            capture_output=True,

Tainted flow: 'piper_bin' from os.environ.get (line 41, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 89% confidence

Finding

The executable path ultimately depends on the WORKSPACE environment variable, allowing an attacker who can influence the environment or workspace contents to redirect execution to a malicious binary. Because the script only checks existence and executability, a trojaned Piper binary in attacker-controlled storage would run with the privileges of the calling process.

Content

Scanner excerpt · scripts/synthesize_universal.py (reported line 68)May include surrounding context.

python

path.unlink()

    try:
        subprocess.run(
            [str(piper_bin), "--model", str(model_path), "--output_file", str(wav_path)],
            input=text.encode("utf-8"),
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/synthesize_universal.py (reported line 81)May include surrounding context.

python

raise SynthesisError(exc.stderr.decode("utf-8", errors="ignore")) from exc

    try:
        subprocess.run(
            [
                "ffmpeg",
                "-y",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script pins the ASR model to a Portuguese-only model, which enforces a specific language behavior rather than offering a user-selectable locale. This matches the policy category for language/locale violations because there is no opt-in, alternative language selection, or justification that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits user-facing strings such as "Vozes disponíveis", "feminina", and "masculina" only in Portuguese. Under the policy for natural-language behavior, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Usage and status messages like "Voz definida para" are hard-coded in Portuguese and shown for normal command execution and errors. Because the file does not offer opt-in language selection or state that the tool is region-specific, this constitutes a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states the user should talk to the agent in Brazilian Portuguese, presenting a fixed language requirement rather than offering a language choice. This matches the language/locale policy concern because the constraint is imposed in natural language without explicit user opt-in or broader locale selection.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The dependency specifier anthropic>=0.51.0,<1.0 is not pinned to a single known-safe release, so the installed version may vary across environments and could resolve to a release affected by published advisories. This creates supply-chain uncertainty and makes it impossible to verify from this file alone whether vulnerable versions are being deployed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The script invokes external binaries (Piper and ffmpeg) to process supplied text, but it provides no print/log message or explanatory comment disclosing that subprocess execution occurs. Because subprocess execution is a safety-relevant operation, some visible disclosure should be present unless it is explicitly communicated as part of the skill's behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.