ClawHub
Back to skill

Security audit

Speech to Text Transcription

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent transcription helper, with disclosed local processing, optional cloud uploads, and limited local preference storage.

Install only if you are comfortable letting the agent handle audio files and, when you choose cloud providers, upload audio to those services. Use local Whisper for sensitive recordings, prefer a virtual environment with pinned dependencies, and review or delete ~/speech-to-text-transcription/ if you do not want saved preferences or transcripts retained.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:94
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 94-96
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash
# Install
pip install openai-whisper

Technical Analysis

The documented installation command retrieves openai-whisper and its transitive dependencies from the active pip package index without specifying reviewed versions or verifying package hashes. The installed code can therefore change after the Skill has been audited.

If an upstream release, transitive dependency, configured package index, or package distribution is compromised, pip may download and execute attacker-controlled installation logic. This is a supply-chain weakness rather than evidence that the currently named package is malicious.

Attack Path

  1. A user selects the local Whisper transcription option.
  2. The Agent follows the installation instruction in SKILL.md.
  3. Pip resolves mutable package and dependency versions from its configured index.
  4. An attacker compromises an upstream release, a transitive dependency, or an index available through the user's pip configuration.
  5. Pip downloads the compromised distribution.
  6. Malicious installation or package code executes with the privileges of the account performing the installation.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the installing user's privileges. The attacker could access files and environment variables available to that account, alter user-owned files, tamper with transcription output, or establish additional user-level compromise. System-wide impact would require the installation to be run with elevated privileges; the Skill does not itself instruct users to elevate privileges.

Remediation
View remediation

Remediation Suggestions

  • Pin openai-whisper to a specifically reviewed version instead of resolving the latest available release.
  • Lock all transitive dependencies and require cryptographic hashes, such as through a hash-verified requirements file generated by a dependency-locking tool.
  • Install into a dedicated virtual environment with only user-level privileges.
  • Explicitly specify and document the trusted official package index, and prevent fallback to untrusted supplemental indexes.
  • Require explicit user confirmation before installing any package.
  • Periodically review and update the pinned dependency set after checking release provenance, vulnerability advisories, and package integrity.
  • Avoid running pip as an administrator or root user.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

OpenAI Whisper API

bash
curl -X POST https://api.openai.com/v1/audio/transcriptions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: multipart/form-data" \
  -F file="@audio.mp3" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

OpenAI Whisper API

bash
curl -X POST https://api.openai.com/v1/audio/transcriptions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: multipart/form-data" \
  -F file="@audio.mp3" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

AssemblyAI (Speaker Diarization)

bash
# Upload
curl -X POST https://api.assemblyai.com/v2/upload \
  -H "Authorization: $ASSEMBLYAI_API_KEY" \
  --data-binary @audio.mp3

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

AssemblyAI (Speaker Diarization)

bash
# Upload
curl -X POST https://api.assemblyai.com/v2/upload \
  -H "Authorization: $ASSEMBLYAI_API_KEY" \
  --data-binary @audio.mp3

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
**This skill does NOT:**
- Store API keys in plain text (use environment variables)
- Auto-upload without confirmation
- Retain files on external servers after processing

## External Endpoints

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup text tells the agent to begin helping as soon as the directory is missing or empty and to 'start helping the user naturally,' which creates a broad activation condition not tightly scoped to an explicit user request. In a conversational system, this can cause the skill to engage on loosely related discussion of audio or transcription and lead to unintended processing of user content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The suggested prompts ask whether the assistant should 'jump in whenever you share audio files' and 'auto-detect voice memos vs meeting recordings,' encouraging ongoing automatic participation without clear boundaries or consent checks. This increases the chance of the skill processing files or sensitive recordings the user did not intend to submit for transcription or classification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file instructs the skill to store provider preferences, use cases, output format, and language in an internal memory file, but it does not require notifying the user or obtaining consent for persistent storage. Persistent retention of behavioral preferences and language data can create privacy risk, surprise users, and expand exposure if that memory is later accessed or repurposed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.