senseaudio-floating-audio-assistant-v2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated audio-assistant purpose, but it handles live audio and credentials with under-scoped configuration and persistence behavior that users should review first.

Install only if you trust the publisher and the local workspace. Before using live capture, verify the ASR endpoint remains the official SenseAudio URL, keep workspace state out of backups or shared archives unless secrets are redacted, and prefer a patched/hash-pinned dependency setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: runtime/realtime_interpreter/organize_senseaudio_transcript.py:272

Finding

Persistent Duplication of the Full AudioClaw Configuration

Content

View full analysis

Path: root = transcript_path.parents[4] home = root / "state" / "realtime_interpreter" / "audioclaw_organizer_home" workspace = home / "workspace" workspace.mkdir(parents=True, exist_ok=True) source_config = Path.home() / ".audioclaw" / "config.json" target_config = home / "config.json" if source_config.exists(): config = json.loads(source_config.read_text(encoding="utf-8")) defaults = config.setdefault("agents", {}).setdefault("defaults", {}) defaults["workspace"] = str(workspace) defaults["max_tokens"] = min(int(defaults.get("max_tokens") or 4096), 4096) defaults["summarize_message_threshold"] = 4 target_config.write_text(json.dumps(config, ensure_ascii=False, indent=2), encoding="utf-8") elif not target_config.exists(): raise SystemExit("AudioClaw config not found in the configured AudioClaw home.") ``` ### Technical Analysis The transcript organization feature creates an isolated AudioClaw home, but it does so by reading and copying the complete `~/.audioclaw/config.json` file into persistent project workspace state. Only a limited set of agent defaults is modified. All other configuration fields remain in the copied document. If the original configuration contains API keys, provider credentials, private endpoints, account identifiers, or other sensitive settings, those values are duplicated even though the organization operation does not need all of them. The copied file is written using the process's default file-creation permissions. The code does not: - Select only the minimum configuration fields needed by the organizer. - Remove or r ...[truncated 1830 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: runtime/realtime_interpreter/runner.py:507

Finding

Unvalidated ASR Endpoint Can Receive the API Key and Captured Audio

Content

View full analysis

argparse.Namespace: parser = argparse.ArgumentParser(description="Mic-only real-time bilingual subtitle prototype for SenseAudio.") parser.add_argument("--config", default=str(DEFAULT_CONFIG_PATH)) parser.add_argument("--env-file", default=str(DEFAULT_ENV_PATH)) ``` ```python def load_config(path: Path) -> dict[str, Any]: return json.loads(path.read_text(encoding="utf-8")) ``` The configured endpoint receives the bearer credential: ```python async def connect(self) -> None: headers = {"Authorization": f"Bearer {self.api_key}"} self.websocket = await websockets.connect( self.endpoint, additional_headers=headers, max_size=2**20, proxy=None, ) ``` The endpoint is taken directly from configuration: ```python original_client = RealTimeASRClient( name="original", endpoint=str(asr["endpoint"]), api_key=api_key, model=str(asr["model"]), target_language=str(translation_cfg["target_language"]) if single_bilingual_stream else None, capture_config=capture, debug=args.debug, ) ``` Captured audio is subsequently sent to the same connection: ```python async def send_audio(self, chunk: bytes) -> None: if self.websocket is None: raise RuntimeError("websocket not connected") await self.websocket.send(chunk) ``` ### Technical Analysis The default configuration points to the declared SenseAudio WebSocket service, but the code treats the endpoint as trusted solely because it appears in a JSON configuration file. Before connecting, the runner does not verify: - That the sc ...[truncated 1971 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: runtime/realtime_interpreter/generate_senseaudio_music.py:326

Finding

Untrusted Generated-Audio URL Is Downloaded Without Destination or Size Restrictions

Content

View full analysis

dict: deadline = time.time() + timeout_seconds last_response: dict = {} while time.time() < deadline: payload = request_json(PENDING_URL_TEMPLATE.format(task_id=task_id), api_key=api_key) last_response = payload audio_url = str(first_data_item(payload).get("audio_url") or "").strip() or find_first_string(payload, ["audio_url", "url", "music_url"]) if audio_url: return payload ``` The returned URL is downloaded without validation or a response-size limit: ```python def download_file(url: str, destination: Path) -> Path: req = Request(normalize_download_url(url), headers={"User-Agent": "AudioClaw-RealtimeInterpreter/1.0"}) last_error: str | None = None for attempt in range(1, NETWORK_RETRY_LIMIT + 1): try: with urlopen(req, timeout=120) as resp: data = resp.read() resolved_suffix = infer_suffix_from_audio_bytes(data, destination.suffix.lower()) resolved_destination = destination.with_suffix(resolved_suffix) resolved_destination.write_bytes(data) if resolved_destination != destination and destination.exists(): destination.unlink() return resolved_destination except (URLError, ssl.SSLError, OSError) as exc: reason = getattr(exc, "reason", None) or str(exc) last_error = str(reason) if attempt >= NETWORK_RETRY_LIMIT: raise SystemExit(f"Failed to download generated audio: {last_error}") time ...[truncated 2983 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: runtime/realtime_interpreter/start_system_subtitle_overlay.sh:20

Finding

Normal Application Startup Automatically Installs Mutable Python Tooling and Dependencies

Content

View full analysis

/dev/null || true)" if [ "$REQ_HASH" != "$INSTALLED_HASH" ]; then python -m pip install --upgrade pip >/dev/null python -m pip install -r "$REQ_FILE" >/dev/null printf '%s\n' "$REQ_HASH" >"$STAMP_FILE" fi ``` The requirement is version-pinned but not hash-pinned: ```text websockets==15.0.1 ``` ### Technical Analysis Starting the normal subtitle overlay can create a virtual environment, upgrade pip to the latest version available from the configured package index, and install the required package. Pinning `websockets` to a version reduces accidental version drift, but the launcher does not: - Pin the pip version being installed. - Require cryptographic hashes for downloaded distributions. - Specify or validate an approved package index. - Disable dependency resolution. - Separate setup from normal application execution. The local `REQ_HASH` protects only the text of `requirements.txt`; it does not authenticate the downloaded wheel, source archive, pip version, or package index response. Python package installation may execute build backends or installation-related code in the user's context. The bundled dependency name is legitimate and no dependency confusion or typosquatting was identified, but the installation pattern creates avoidable supply-chain exposure during routine startup. ### Attack Path 1. The user launches the floating subtitle assistant on a new system or after the requirement ...[truncated 956 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (114)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied code chunk does not implement or directly manage SenseAudio assistant functions such as audio processing, subtitles, ASR/translation, TTS, music generation, project organization, or audio routing. Instead, it serves as a platform-specific launcher/build script for a macOS WebView overlay host. While this could be a supporting UI component in a broader system, the declared description focuses on controlling and packaging the SenseAudio floating audio assistant and its audio-related features, which is materially different from the narrow behavior shown here. Therefore this chunk is best classified as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code only configures the Vite development/build environment for a React cross-platform overlay. While this could be a supporting part of a UI for the described system, the chunk itself does not implement or directly control any of the declared SenseAudio assistant capabilities. Its primary purpose is generic frontend tooling configuration, which is materially different from the declared operational and feature-focused description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code's concrete behavior is limited to building and launching a utility that lists capture devices. That is much narrower and materially different from the declared purpose of controlling and managing the broader SenseAudio assistant and its user-facing features. While audio device handling could be related to configuration, the description does not specifically disclose device enumeration, and the primary purpose here is not opening, stopping, debugging, packaging, or operating the assistant's advertised features.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description centers on managing or debugging the SenseAudio floating audio assistant and audio-centric capabilities such as subtitles, ASR/translation, TTS, music generation, and audio routing. This code chunk does not open, stop, configure, debug, or package the assistant, nor does it process audio. Instead, its primary function is to take copied clipboard text from a file, ask the AudioClaw agent to reorganize it into structured Chinese Markdown, and save the results. While the broad description mentions 'recent-project organization' and 'copied-text TTS,' neither matches this specific behavior: the code organizes clipboard text content, not projects, and performs no TTS. Therefore the code's primary purpose is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code chunk has a narrow, concrete purpose: organize an existing saved SenseAudio transcript by calling the AudioClaw agent and saving Markdown notes/metadata. It does not open or stop the assistant, configure or debug the app generally, package anything, manage subtitles, perform translation, TTS, music generation, or audio routing. While the declared description mentions 'recent-project organization,' this script is about transcript organization rather than general project organization. Because the description presents a much broader multi-function skill than the code actually provides, the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad operational skill for controlling and debugging the SenseAudio assistant within AudioClaw and related audio features. The supplied code does something much narrower and different: it benchmarks/probes sherpa-onnx streaming speech recognition from a local WAV file. While there is a loose thematic overlap with ASR/debugging, the actual code does not interact with SenseAudio, AudioClaw, system audio, translation, TTS, music generation, project management, or macOS routing. Its primary purpose is materially different from the declared purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk does not implement or directly support the declared SenseAudio/AudioClaw assistant management behavior. Instead, it sets up directory locations for a separate component called 'realtime_interpreter'. While path setup can be a supporting detail, here the named target tool and state location are materially different from the declared purpose, indicating the code belongs to another skill or subsystem.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.2 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

browserslist 4.28.2 is explicitly locked and the advisories describe crash/prototype-write behavior and unbounded memory growth when handling untrusted browserslist-stats or crafted query/result patterns. Although primarily a build-time component, this package is often used in tooling chains, so malicious project data or CI inputs could cause denial of service or unsafe object mutation during builds.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

nanoid 3.3.11 is locked and the advisories indicate edge-case infinite loops and integer-wrap issues in non-secure or custom generator paths. Because this package is used transitively by tooling such as PostCSS, the practical risk is mostly build-time denial of service if hostile parameters or crafted integration paths are reachable, making the dependency genuinely vulnerable but contextually less severe than a runtime auth/token use case.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

postcss 8.5.8 is present and the listed advisories include arbitrary file read, incomplete sourcemap-related fixes, and XSS in generated CSS output. Even though PostCSS is commonly used in the build pipeline, these issues become significant if attacker-controlled CSS, sourcemap comments, or style content can enter the toolchain, which could affect developer machines, CI secrets, or generated frontend assets.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

vite 5.4.21 is directly included and affected by path traversal in optimized dependency map handling, Windows fs deny bypass, and UNC path launch-editor NTLM hash disclosure. In this skill's context, the overlay is a desktop/Tauri project where Vite is likely used during development, so these flaws are real and especially relevant to local developer environments and CI systems rather than end-user runtime, but they can still expose files or credentials on developer machines.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency resolves to a Vite version with known advisories, including path traversal in optimized dependency source map handling, a Windows alternate-path deny-list bypass, and NTLMv2 hash disclosure via UNC path handling. Because this project packages a cross-platform overlay and likely relies on local dev/build workflows, the main risk is compromise of developer environments or leakage of local files/credentials when running the dev server or related tooling, especially on Windows.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · runtime/realtime_interpreter/generate_senseaudio_music.py (reported line 140)May include surrounding context.

python

)
    if prompt_extra.strip():
        prompt = prompt[:-len("[outro-medium]")] + f"补充要求：{prompt_extra.strip()} ; [outro-medium]"
    return prompt


def build_lyrics_prompt(source_text: str, *, style_preset: str, prompt_extra: str) -> str:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · runtime/realtime_interpreter/generate_senseaudio_music.py (reported line 154)May include surrounding context.

python

)
    if prompt_extra.strip():
        prompt = prompt[:-len("[outro-medium]")] + f"补充要求：{prompt_extra.strip()} ; [outro-medium]"
    return prompt


def build_lyrics_prompt(source_text: str, *, style_preset: str, prompt_extra: str) -> str:

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The script copies the full parent process environment into the child process with dict(**os.environ), which can expose secrets such as API tokens, credentials, proxy settings, and internal configuration to the spawned agent binary. In this skill context, that risk is more significant because the child is an agent executable that may log diagnostics, load plugins, or communicate externally, increasing the chance that inherited secrets are mishandled or exfiltrated.

Content

Scanner excerpt · runtime/realtime_interpreter/organize_senseaudio_transcript.py (reported line 320)May include surrounding context.

python

"--message",
        prompt,
    ]
    env = dict(**os.environ)
    organizer_home = isolated_audioclaw_home(transcript_path)
    env["AUDIOCLAW_HOME"] = str(organizer_home)
    completed = subprocess.run(command, capture_output=True, text=True, check=False, env=env)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · runtime/realtime_interpreter/subtitle_overlay.py (reported line 62)May include surrounding context.

python

]
        if not translation_enabled:
            command.append("--no-translation")
        env = os.environ.copy()
        env.setdefault("PYTHONUNBUFFERED", "1")
        self.process = subprocess.Popen(
            command,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/senseaudio_api_smoke.py (reported line 23)May include surrounding context.

python

def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="Diagnostic smoke test for SenseAudio integration used by this skill.")
    parser.add_argument("--env-file", default="", help="Optional .env file. Defaults to workspace/.env discovered from this skill.")
    parser.add_argument("--live-tts", action="store_true", help="Make a tiny real SenseAudio TTS request and report chunk metadata.")
    parser.add_argument("--voice-id", default="female_0006_a")
    parser.add_argument("--text", default="SenseAudio floating audio assistant smoke test.")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/status-senseaudio-floating-audio-assistant.sh (reported line 25)May include surrounding context.

sh

def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="Diagnostic smoke test for SenseAudio integration used by this skill.")
    parser.add_argument("--env-file", default="", help="Optional .env file. Defaults to workspace/.env discovered from this skill.")
    parser.add_argument("--live-tts", action="store_true", help="Make a tiny real SenseAudio TTS request and report chunk metadata.")
    parser.add_argument("--voice-id", default="female_0006_a")
    parser.add_argument("--text", default="SenseAudio floating audio assistant smoke test.")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/status-senseaudio-floating-audio-assistant.sh (reported line 28)May include surrounding context.

sh

def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="Diagnostic smoke test for SenseAudio integration used by this skill.")
    parser.add_argument("--env-file", default="", help="Optional .env file. Defaults to workspace/.env discovered from this skill.")
    parser.add_argument("--live-tts", action="store_true", help="Make a tiny real SenseAudio TTS request and report chunk metadata.")
    parser.add_argument("--voice-id", default="female_0006_a")
    parser.add_argument("--text", default="SenseAudio floating audio assistant smoke test.")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/realtime_interpreter/cross_platform_overlay/overlay_host.py (reported line 31)May include surrounding context.

python

# shellcheck source=common.sh
source "$SCRIPT_DIR/common.sh"
RUNS_DIR="$STATE_DIR/runs"
ENV_FILE="$WORKSPACE_DIR/.env"

echo "SenseAudio Floating Audio Assistant"
echo

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/realtime_interpreter/generate_senseaudio_music.py (reported line 355)May include surrounding context.

python

# shellcheck source=common.sh
source "$SCRIPT_DIR/common.sh"
RUNS_DIR="$STATE_DIR/runs"
ENV_FILE="$WORKSPACE_DIR/.env"

echo "SenseAudio Floating Audio Assistant"
echo

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/realtime_interpreter/runner.py (reported line 29)May include surrounding context.

python

# shellcheck source=common.sh
source "$SCRIPT_DIR/common.sh"
RUNS_DIR="$STATE_DIR/runs"
ENV_FILE="$WORKSPACE_DIR/.env"

echo "SenseAudio Floating Audio Assistant"
echo

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/realtime_interpreter/subtitle_overlay.py (reported line 19)May include surrounding context.

python

# shellcheck source=common.sh
source "$SCRIPT_DIR/common.sh"
RUNS_DIR="$STATE_DIR/runs"
ENV_FILE="$WORKSPACE_DIR/.env"

echo "SenseAudio Floating Audio Assistant"
echo

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/realtime_interpreter/subtitle_overlay.swift (reported line 989)May include surrounding context.

text

# shellcheck source=common.sh
source "$SCRIPT_DIR/common.sh"
RUNS_DIR="$STATE_DIR/runs"
ENV_FILE="$WORKSPACE_DIR/.env"

echo "SenseAudio Floating Audio Assistant"
echo

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/realtime_interpreter/subtitle_overlay.swift (reported line 4575)May include surrounding context.

text

# shellcheck source=common.sh
source "$SCRIPT_DIR/common.sh"
RUNS_DIR="$STATE_DIR/runs"
ENV_FILE="$WORKSPACE_DIR/.env"

echo "SenseAudio Floating Audio Assistant"
echo

Static analysis

No suspicious patterns detected.