ClawHub

transcribe

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward cloud speech-to-text helper; the main thing to understand is that selected audio is uploaded to SkillBoss for transcription.

Install this only if you are comfortable sending chosen audio files to SkillBoss for processing. Avoid confidential or regulated recordings unless you trust SkillBoss's privacy and retention practices, and keep SKILLBOSS_API_KEY protected because it may grant account access or incur usage charges.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documentation instructs users to base64-encode local audio and send it to a third-party API for transcription, but it does not clearly warn that potentially sensitive voice content will leave the local environment. This creates a privacy and data-governance risk because users may unknowingly transmit confidential or regulated audio to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
API_BASE = "https://api.skillbossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
Confidence
94% confidence
Finding
requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal