ClawHub
Back to skill

Security audit

Assembly Large Audio Transcriber

Security checks for vulnerabilities and agentic risk

Overview

The skill does the advertised AssemblyAI transcription work, but it asks users to share an API key through chat and automatically stores sensitive transcripts without clear opt-out controls.

Install only if you are comfortable sending selected audio files to AssemblyAI and storing transcript files locally. Configure ASSEMBLYAI_API_KEY through a secure environment or secret mechanism, do not paste it into chat, and delete or protect generated transcript files when recordings contain private or business-sensitive content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Note
Location
SKILL.md:22
Finding

Unnecessary Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-27
Vulnerability Type: Unpinned and unnecessary package installation
Risk Level: Low

Vulnerable Code

bash
pip install requests

Technical Analysis

The installation instructions retrieve the latest available requests package and its transitive dependencies without pinning versions or verifying package hashes. This makes installation behavior dependent on mutable upstream package repositories.

The bundled executable uses Python's standard-library urllib module rather than requests. Consequently, this dependency installation is not required for the Skill's implemented functionality and unnecessarily expands its software supply-chain attack surface.

No evidence indicates that the current requests package is malicious. The risk arises from instructing users to install mutable third-party components that the executable does not need.

Attack Path

  1. A user follows the installation instructions.
  2. pip resolves the latest requests release and its transitive dependencies from the configured package index.
  3. If an upstream release, dependency, package index, or local package-index configuration has been compromised, malicious package code may be installed.
  4. Such code may subsequently execute during installation or when imported by a documentation-derived implementation.

Impact Assessment

Successful exploitation would execute package-controlled code with the privileges of the user running pip. The accessible scope could include that user's files, environment variables, credentials, and network permissions. The instruction does not itself elevate privileges or request administrative installation.

Remediation
View remediation

Remediation Suggestions

  • Remove the pip install requests instruction because the bundled implementation uses only standard-library modules.
  • Update the documentation examples to use the same urllib implementation as the executable.
  • If requests is intentionally retained for separate examples, declare an audited version in a requirements file.
  • Use hashes and an integrity-enforcing installation mode, such as pip install --require-hashes.
  • Periodically audit both direct and transitive dependencies for known vulnerabilities.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:36
Finding

API Key Solicitation Through an Agent Conversation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 36
Vulnerability Type: Unsafe secret-handling instruction
Risk Level: Medium

Vulnerable Instruction

text
Alternatively, tell the agent your AssemblyAI API key and it will configure it.

Technical Analysis

The documentation invites users to disclose an AssemblyAI API key through an Agent conversation instead of requiring configuration through a dedicated secret-management mechanism. Credentials entered into a conversation may be retained in chat histories, application telemetry, debugging traces, tool logs, or other platform records.

The executable itself follows a safer pattern by reading ASSEMBLYAI_API_KEY from the environment. It does not print the key and uses it only as an authorization header in requests to AssemblyAI. The vulnerability is therefore in the credential-handling instruction, not evidence of hidden credential exfiltration by the script.

Attack Path

  1. A user follows the documentation and pastes an AssemblyAI API key into the conversation.
  2. The message or associated execution context is retained by conversation-history, observability, logging, or support systems.
  3. A person or service with access to those records obtains the plaintext key.
  4. The exposed key is used to submit transcription jobs or otherwise consume the victim's AssemblyAI account resources until it is revoked.

Impact Assessment

Exposure grants the capabilities associated with the compromised AssemblyAI API key. Likely effects include unauthorized API usage, account charges or quota consumption, and access to operations or resources permitted by AssemblyAI's key model. This does not directly grant local operating-system privileges unless the same credential is reused elsewhere.

Remediation
View remediation

Remediation Suggestions

  • Remove all instructions asking users to provide API keys through chat.
  • Require configuration through the hosting platform's secret store or a locally established environment variable.
  • Explicitly warn users not to paste credentials into conversations, command history, source files, or ordinary configuration files.
  • Redact authorization headers and secret values from application and proxy logs.
  • Document key rotation and revocation procedures for accidental disclosure.
  • Where supported by the provider, use narrowly scoped, short-lived credentials and account-level usage limits.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/transcribe_assemblyai.py:138
Finding

Sensitive Transcription Results Persisted Without Restrictive Permissions or User Opt-Out

Content
View full analysis

Vulnerability Details

File Location: scripts/transcribe_assemblyai.py, lines 138-141
Vulnerability Type: Insecure plaintext storage of potentially sensitive data
Risk Level: Low

Vulnerable Code

python
json_path = file_path + ".transcript.json"
with open(json_path, "w", encoding="utf-8") as f:
    json.dump(result, f, ensure_ascii=False, indent=2)
print(f"\n[存档] JSON原始数据: {json_path}")

Technical Analysis

After every successful transcription, the script automatically writes the complete AssemblyAI response to a plaintext JSON file beside the source audio. The response can contain transcript text, speaker-separated utterances, timestamps, language information, and other metadata.

The file is created using the process's ambient umask; the code does not explicitly restrict permissions. On systems with a permissive umask, other local users or services may be able to read the transcript. Users also cannot disable persistence or choose a protected output destination through the command-line interface.

This storage is related to the declared transcription functionality, but unconditional archival of the complete response is not necessary merely to display the requested transcript.

Attack Path

  1. A user submits an audio recording containing confidential, personal, legal, medical, or business information.
  2. The script obtains the transcription and automatically writes the complete response to <audio-path>.transcript.json.
  3. The resulting permissions are inherited from the process environment rather than being explicitly restricted.
  4. Another local account, shared-directory participant, backup process, synchronization service, or indexing system gains access to the plaintext transcript.

Impact Assessment

Exploitation can disclose all information represented in the transcription response, including conversation content, speaker labels, timestamps, and metadata. The scope is limit ...[truncated 171 chars]

Remediation
View remediation

Remediation Suggestions

  • Make transcript persistence opt-in through an explicit command-line option.
  • Allow the user to select a protected output path.
  • Create output files atomically with owner-only permissions, such as mode 0600, rather than relying on the ambient umask.
  • Refuse to overwrite existing files unless the user explicitly authorizes it.
  • Offer an option to retain only the formatted transcript instead of the complete API response.
  • Document the sensitivity, retention period, backup implications, and secure-deletion procedure for transcript files.
  • Consider encryption at rest when transcripts must be retained on shared or managed systems.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill uses sensitive capabilities including environment-variable access, network exfiltration to a third-party API, and local file persistence, but it does not declare an explicit tool/permission scope. This weakens reviewability and consent boundaries because an agent may exercise broader capabilities than the manifest makes clear.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description is written as a Chinese-only instruction and later examples default transcription language to "zh", which indicates a locale preference without presenting a user choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the regional constraint is documented and justified.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly asks the user to provide their AssemblyAI API key directly to the agent for configuration. Having users transmit secrets through conversational flow increases the chance of logging, unintended retention, reuse in other contexts, or disclosure to unauthorized tools/components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill encourages use on local files but does not clearly warn users that those files will be uploaded to AssemblyAI, a third-party service. This creates a consent and data-handling problem, especially for confidential audio, because users may believe processing is local.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
# 1. 上传文件获取 upload_url
def upload_file(file_path):
    with open(file_path, "rb") as f:
        response = requests.post(
            "https://api.assemblyai.com/v2/upload",
            headers=HEADERS,
            data=f,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
# 1. 上传文件获取 upload_url
def upload_file(file_path):
    with open(file_path, "rb") as f:
        response = requests.post(
            "https://api.assemblyai.com/v2/upload",
            headers=HEADERS,
            data=f,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
# 1. 上传文件获取 upload_url
def upload_file(file_path):
    with open(file_path, "rb") as f:
        response = requests.post(
            "https://api.assemblyai.com/v2/upload",
            headers=HEADERS,
            data=f,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
}
    if language == "auto":
        payload["language_detection"] = True
    response = requests.post(
        "https://api.assemblyai.com/v2/transcript",
        headers=HEADERS,
        json=payload,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
}
    if language == "auto":
        payload["language_detection"] = True
    response = requests.post(
        "https://api.assemblyai.com/v2/transcript",
        headers=HEADERS,
        json=payload,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions direct the agent to write transcripts to disk without clearly disclosing this storage behavior to the user. Silent local persistence of meeting transcripts can expose sensitive conversations beyond the immediate task and violate user expectations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow instructs persistent storage of full meeting transcripts in memory storage, which may contain highly sensitive business or personal information. Retaining complete transcripts creates a durable secrecy and privacy risk beyond the immediate transcription task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow instructs the agent to archive full meeting transcripts to local persistent storage even though transcription does not inherently require long-term retention. Persisting potentially sensitive meeting content increases exposure to later unauthorized access, secondary use, or accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script uploads local audio files to AssemblyAI, an external third-party service, without an explicit privacy or data-transmission warning at the point of use. In a transcription skill this behavior is expected, but it is still risky because audio may contain sensitive personal, financial, medical, or corporate information and users may assume processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Most status, error, and usage messages are presented only in Chinese, regardless of user preference or environment. This is a natural-language locale constraint that is neither optional nor justified as region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This line performs external transmission of the local audio file to AssemblyAI. In the context of a transcription skill this is functionally necessary rather than malicious, but it is still a real data-exfiltration boundary because potentially sensitive local content leaves the host and is sent to a third party.

Content

Scanner excerpt · scripts/transcribe_assemblyai.py (reported line 35)May include surrounding context.

python
with open(file_path, "rb") as f:
        data = f.read()
    req = urllib.request.Request(
        "https://api.assemblyai.com/v2/upload",
        data=data,
        headers=_headers(),
        method="POST"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
print(f"[提交] 语言={language}, 启用说话人分离...")
    req = urllib.request.Request(
        "https://api.assemblyai.com/v2/transcript",
        data=json.dumps(payload).encode(),
        headers={**_headers(), "Content-Type": "application/json"},
        method="POST"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
print(f"[提交] 语言={language}, 启用说话人分离...")
    req = urllib.request.Request(
        "https://api.assemblyai.com/v2/transcript",
        data=json.dumps(payload).encode(),
        headers={**_headers(), "Content-Type": "application/json"},
        method="POST"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
print(f"[提交] 语言={language}, 启用说话人分离...")
    req = urllib.request.Request(
        "https://api.assemblyai.com/v2/transcript",
        data=json.dumps(payload).encode(),
        headers={**_headers(), "Content-Type": "application/json"},
        method="POST"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
print(f"[提交] 语言={language}, 启用说话人分离...")
    req = urllib.request.Request(
        "https://api.assemblyai.com/v2/transcript",
        data=json.dumps(payload).encode(),
        headers={**_headers(), "Content-Type": "application/json"},
        method="POST"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/transcribe_assemblyai.py (reported line 59)May include surrounding context.

python
print(f"[提交] 语言={language}, 启用说话人分离...")
    req = urllib.request.Request(
        "https://api.assemblyai.com/v2/transcript",
        data=json.dumps(payload).encode(),
        headers={**_headers(), "Content-Type": "application/json"},
        method="POST"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/transcribe_assemblyai.py (reported line 72)May include surrounding context.

python
print(f"[提交] 语言={language}, 启用说话人分离...")
    req = urllib.request.Request(
        "https://api.assemblyai.com/v2/transcript",
        data=json.dumps(payload).encode(),
        headers={**_headers(), "Content-Type": "application/json"},
        method="POST"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The error message tells users to share their AssemblyAI API key with a named person for configuration. Encouraging users to disclose credentials to another individual is unsafe because it normalizes credential sharing and can lead to account compromise, unauthorized usage, and loss of auditability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script writes the full raw transcription API response to a local JSON file, which can contain sensitive transcript content, speaker labels, and metadata. This is not overtly malicious, but it creates a confidentiality risk because users may not realize sensitive speech data is being persisted to disk by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script stores transcription results to a local JSON file without clearly warning the user that potentially sensitive spoken content and metadata will be saved on disk. This can expose transcripts to other local users, backups, sync tools, or later unintended disclosure.

Content

No source excerpt is available for this finding.