Aliyun Asr

• Analyzed: May 12, 2026, 3:43 AM
• Findings: 1
• Version: 1.0.10
• Hash: 1e63fe736682dca032de74425582cf8ff172a022693c1dd85be076291ed7adb4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `subprocess.run()` to execute `ffmpeg` in `aliyun_pure_asr.py`. While intended for legitimate audio format conversion, passing a potentially user-controlled `audio_file` path to an external command introduces a shell injection vulnerability risk, even when arguments are provided as a list. This capability, if exploited, could lead to arbitrary command execution within the OpenClaw agent's environment. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints or prompt injection attempts in SKILL.md.