ClawHub
Back to skill

Security audit

AudioClaw Skills Voice Intake

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a voice-transcription purpose, but it uses unbundled runtime code, local credential bootstrap, and a hard-coded cloned voice handoff that require review before installation.

Install only if you trust the AudioClaw/SenseAudio environment, accept that user voice recordings are sent to the documented remote ASR service, and can constrain the runtime to trusted shared modules. Review or remove the cloned voice handoff and make credential lookup explicit before using this in production.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
agents/openai.yaml:4
Finding

Cross-Skill Instruction Hijacking Through a Hard-Coded Cloned Voice Identity

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/openclaw_voice_intake.py:10
Finding

Arbitrary Code Execution Through Ancestor-Controlled Python Module Loading

Content
View full analysis
None: current = Path(__file__).resolve() for parent in current.parents: candidate = parent / "_shared" / "senseaudio_env.py" if candidate.exists(): candidate_dir = str(candidate.parent) if candidate_dir not in sys.path: sys.path.insert(0, candidate_dir) from senseaudio_env import ensure_senseaudio_env ensure_senseaudio_env() return _bootstrap_shared_senseaudio_env() ``` ### Technical Analysis The bootstrap routine searches every ancestor of the script for `_shared/senseaudio_env.py`. When it finds a matching file, it inserts that file's directory at the beginning of `sys.path` and imports `senseaudio_env`. Python executes module-level code during import. Therefore, a matching file does not need to provide a legitimate implementation before its payload runs. Any party capable of placing or modifying `_shared/senseaudio_env.py` under a searched ancestor directory can execute arbitrary Python code when the Skill starts. Prepending the discovered directory to `sys.path` also gives that location priority in subsequent module resolution. This can facilitate additional dependency spoofing if imports use names that exist in the attacker-controlled directory. The dynamically loaded implementation is outside the audited project. Consequently, the effective runtime behavior—including the documented credential bootstrap—is not fully represented by the reviewed package. The script also imports `senseaudio_api_guard`, which is absent from the supplied project, further demonstrating reliance on unbundled runtime components. Exploitation depends on write access to a searched ancestor loc ...[truncated 1911 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The skill instructs runtime bootstrap logic to replace a provided token with a real API key loaded from a local credentials file under the user's home directory. Accessing a persistent local secrets store as part of skill execution expands credential exposure and creates a path for unintended secret use or leakage, especially in multi-skill or multi-tenant agent environments.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
This skill now treats `SENSEAUDIO_API_KEY` as the default API key source again.

Runtime rules:
- If the host app injects `SENSEAUDIO_API_KEY` as an AudioClaw login token such as `v2.public...`, the shared bootstrap will replace it with the real `sk-...` value from `~/.audioclaw/workspace/state/senseaudio_credentials.json` before ASR starts.
- `--api-key-env` still works, but the default runtime path is `SENSEAUDIO_API_KEY`.

## Commands

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes capabilities that involve shell execution, filesystem access, environment variable use, and outbound network calls, but it does not declare any explicit tool scope or permissions boundary. That omission can cause the skill to run with broader-than-expected privileges, making accidental misuse or unsafe composition with other agent capabilities more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The default prompt instructs the agent to prefer a specific prepared clone voice_id for voice replies without requiring explicit user opt-in at the point of use. Hard-coding a cloned voice preference can cause unauthorized voice impersonation, consent violations, or privacy/compliance issues if the selected voice belongs to a real person or is used outside the user's expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language fallback message 这段语音我没有听清楚，请再说一次。 is always used when clarification is needed, regardless of the user's preferred language or locale. This imposes a specific language choice with no opt-in or documented locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This script sends user audio and associated request parameters to a remote ASR service via transcribe(request, api_key) and records the API endpoint in the manifest, but provides no in-file notice, consent gate, or minimization around remote transmission. In a voice-intake skill, this can expose sensitive spoken content, identifiers, and metadata to an external service without clear user awareness.

Content

No source excerpt is available for this finding.

Tainted flow: 'manifest' from os.getenv (line 129, credential/environment) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/openclaw_voice_intake.py (reported line 168)May include surrounding context.

python
if args.out_json:
        out_path = Path(args.out_json)
        out_path.parent.mkdir(parents=True, exist_ok=True)
        out_path.write_text(json.dumps(manifest, ensure_ascii=False, indent=2), encoding="utf-8")

    json.dump(manifest, sys.stdout, ensure_ascii=False, indent=2)
    sys.stdout.write("\n")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
from typing import Dict, List, Optional, Sequence, Tuple, Union


API_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
SUPPORTED_SUFFIXES = {".wav", ".mp3", ".ogg", ".opus", ".flac", ".aac", ".m4a", ".mp4"}
MAX_BYTES = 10 * 1024 * 1024
MAX_SECONDS = 7200

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/openclaw_voice_intake.md (reported line 7)May include surrounding context.

md
from typing import Dict, List, Optional, Sequence, Tuple, Union


API_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
SUPPORTED_SUFFIXES = {".wav", ".mp3", ".ogg", ".opus", ".flac", ".aac", ".m4a", ".mp4"}
MAX_BYTES = 10 * 1024 * 1024
MAX_SECONDS = 7200

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/senseaudio_asr_client.py (reported line 14)May include surrounding context.

python
from typing import Dict, List, Optional, Sequence, Tuple, Union


API_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
SUPPORTED_SUFFIXES = {".wav", ".mp3", ".ogg", ".opus", ".flac", ".aac", ".m4a", ".mp4"}
MAX_BYTES = 10 * 1024 * 1024
MAX_SECONDS = 7200

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/senseaudio_asr_client.py (reported line 52)May include surrounding context.

python
def detect_duration_seconds(path: Path) -> float:
    try:
        output = subprocess.check_output(["/usr/bin/afinfo", str(path)], stderr=subprocess.STDOUT)
    except (subprocess.CalledProcessError, FileNotFoundError):
        return 0.0
    for raw_line in output.decode("utf-8", "ignore").splitlines():

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code uploads raw audio content to a third-party ASR endpoint, but this file contains no mechanism to ensure the caller has obtained user consent or surfaced a privacy disclosure before transmission. Because voice recordings often contain sensitive personal data, silent external transfer can create privacy, compliance, and data-governance exposure in the skill context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.