ClawHub
Back to skill

Security audit

Local Whisper

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does local transcription, but its private/local claims are undermined by under-disclosed cloud transcription paths and an overly broad local daemon.

Review before installing. Use only if you are comfortable forcing a local backend, keeping OPENAI_API_KEY and GROQ_API_KEY out of the skill environment unless cloud transcription is intentional, keeping CLAWD_WHISPER_URL on localhost, and avoiding the large-file helper with untrusted filenames until its path handling is fixed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation instructs users to run shell commands, install Python dependencies, start a daemon, copy a LaunchAgent, and expose a local HTTP service, yet the metadata declares no permissions. This mismatch weakens user consent and platform enforcement because the skill clearly requires shell, network, file write, and environment access that are not transparently declared.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The daemon accepts JSON requests containing arbitrary local file paths and then reads and transcribes those files without any path restriction or authentication. Even though the server binds to 127.0.0.1, any local process able to connect can coerce the service into accessing unintended files, expanding its capability from speech-to-text on supplied audio bytes to a local file read/transcription primitive.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script advertises local/private transcription but first attempts an HTTP POST to a daemon endpoint, which introduces external communication into a supposedly local workflow. Even if the default target is localhost, the URL is overrideable via CLAWD_WHISPER_URL, so the skill can be redirected to a non-local service and transmit sensitive metadata or content without clear disclosure.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The daemon URL is configurable from the environment and used directly in curl, enabling posting to an arbitrary endpoint unrelated to the stated local transcription purpose. In a skill handling private voice messages, this creates a straightforward exfiltration path for sensitive user data or file references if the environment is influenced by another component or deployment configuration.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill metadata promises private local speech-to-text with no API costs, but the module explicitly supports OpenAI and Groq cloud transcription backends. This creates a deceptive trust boundary: users may provide sensitive audio assuming it stays local when the code is capable of sending it to third parties.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The auto-selection logic falls back to OpenAI or Groq when local MLX is unavailable and corresponding API keys exist in the environment. In a skill advertised as local and private, this can silently redirect audio to paid external services without user awareness, causing privacy loss and unexpected charges.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code reads OpenAI and Groq API credentials for a skill positioned as local/private transcription. While reading environment variables is common, in this context it expands capability beyond the declared purpose and enables covert use of external services if keys are present.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This code opens the user audio file and submits it to OpenAI or Groq transcription endpoints, directly transferring potentially sensitive voice data outside the local environment. That behavior contradicts the privacy-focused skill description and can expose personal, confidential, or regulated content to third-party processors.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The /transcribe endpoint reads any path provided in JSON and discloses whether the file exists, then processes it, with no user confirmation, warning, or access control. In this skill context, the daemon is meant to service messaging workflows, so hidden local file access is broader than expected and can be abused by other local software to inspect or process private audio files on the host.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script sends the audio file path in JSON to the daemon over HTTP without notifying the user that request data is being transmitted. While the path is not the audio bytes themselves, filesystem paths can reveal usernames, directory structures, chat identifiers, or other sensitive metadata, and the receiving daemon may use that path to access local files.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The API transcription path sends audio to external providers without any visible user-facing warning, consent mechanism, or privacy disclosure in this file. In the context of a skill marketed as private local transcription, the lack of disclosure materially increases the chance of unauthorized or unexpected data sharing.

External Transmission

Medium
Category
Data Exfiltration
Content
)
    
    local response
    response=$(curl -s -X POST "$DAEMON_URL/transcribe" \
        -H "Content-Type: application/json" \
        -d "$json_payload" \
        --connect-timeout 2 \
Confidence
89% confidence
Finding
curl -s -X POST "$DAEMON_URL/transcribe" \ -H "Content-Type: application/json" \ -d

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
77% confidence
Finding
python-dotenv==1.0.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.