ClawHub
Back to skill

Security audit

Mlx Whisper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local transcription helper, with the main caveat that it installs an unpinned Python command-line dependency.

Install this only if you are comfortable with pip installing mlx-whisper and downloading Whisper models on first use. For stronger assurance, install in an isolated environment and prefer a pinned, reviewed package version when available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Unpinned Executable Python Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Complete Code Snippet:

yaml
metadata: {"clawdbot":{"emoji":"🍎","requires":{"bins":["mlx_whisper"]},"install":[{"id":"pip","kind":"pip","package":"mlx-whisper","bins":["mlx_whisper"],"label":"Install mlx-whisper (pip)"}]}}

Technical Analysis

The installation metadata directs the host to install mlx-whisper from a Python package index without specifying an exact dependency version or an artifact integrity hash. The skill's own version: 1.0.0 does not pin the version of the separately installed Python package.

Consequently, installation resolves whichever package release the configured index currently serves. The installed implementation can therefore change after this skill has been reviewed. If the package publisher, distribution account, package index, or dependency chain is compromised, a malicious release could execute code during installation or when the mlx_whisper command is invoked.

This finding identifies supply-chain exposure rather than evidence that the currently published mlx-whisper package is malicious.

Attack Path

  1. An attacker compromises the package publisher, package repository, configured package index, or a dependency used by mlx-whisper.
  2. The attacker publishes or causes resolution to a malicious package release.
  3. A user installs the skill dependency through the unpinned pip declaration.
  4. The package manager retrieves the attacker-controlled release because no exact version or trusted hash constrains resolution.
  5. Malicious code executes during package installation or upon invocation of the installed mlx_whisper executable.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account performing installation or running mlx_whisper. The resulting ...[truncated 354 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin mlx-whisper to an exact, audited package version rather than accepting the latest available release.
  • Verify downloaded artifacts using approved cryptographic hashes, such as pip's hash-checking mode with a locked requirements file.
  • Install only from an explicitly configured and trusted package index.
  • Use a reproducible lock file that also constrains transitive dependencies.
  • Review package release provenance and signatures where available.
  • Run installation and transcription under a least-privileged account or isolated environment.
  • Keep the skill's own version and the external dependency version documented separately to avoid implying that version: 1.0.0 constrains the installed package.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.