discord voice memo upgrade

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:45 AM UTC
• Version: 1.0.0

Overview

This is a user-directed core bot patch, not clear malware, but it needs review because it overwrites Clawdbot runtime files and includes sensitive debug logging plus loosely scoped external TTS endpoints.

Install only after reviewing the replacement files against your Clawdbot version. Apply it first in a non-production environment, keep backups, remove or gate all TTS debug console logs before real use, and avoid custom TTS endpoints unless they are explicitly trusted and secured. Assume any enabled remote TTS provider receives the text being spoken.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: patch/dispatch-from-config.js:109

Finding

Unconditional Debug Logging Exposes Message Content and API Key Prefixes

Content

View full analysis

config.maxTextLength) { console.log(`[TTS-SPEECH] FAIL: text too long`); return { success: false, error: `Text too long (${params.text.length} chars, max ${config.maxTextLength})`, }; } const userProvider = getTtsProvider(config, prefsPath); const overrideProvider = params.overrides?.provider; const provider = overrideProvider ?? userProvider; const providers = resolveTtsProviderOrder(provider); console.log(`[TTS-SPEECH] provider=${provider} userProvider=${userProvider} providers=${JSON.stringify(providers)} apiKey=${config.elevenlabs.apiKey ? "SET(" + config.elevenlabs.apiKey.slice(0, 8) + "...)" : "MISSING"}`); ``` ### Technical Analysis The patch writes diagnostic information directly to standard output using unconditional `console.log` calls. The dispatcher includes the first 80 characters of `ctx.Body`, which may contain private conversations, authentication material, personal d ...[truncated 2070 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: patch/tts.js:699

Finding

Configurable TTS Endpoints Can Receive Provider Credentials and Message Content Without Origin Validation

Content

View full analysis

controller.abort(), timeoutMs); try { const url = new URL(`${normalizeElevenLabsBaseUrl(baseUrl)}/v1/text-to-speech/${voiceId}`); if (outputFormat) { url.searchParams.set("out ...[truncated 4795 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

cp patch/tts.js $CLAWDBOT_DIR/lib/node_modules/clawdbot/dist/tts/

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The patch adds debug logging that can expose sensitive runtime data, including partial message bodies, media metadata, provider selections, and a visible prefix of an API key. In production or shared log environments, this can leak user content and operational secrets to administrators, support staff, log processors, or attackers who gain log access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README explicitly documents debug logging that includes TTS provider resolution and API key status, but only says logs should be removed before production without warning that such logs can expose sensitive operational details. Even if the key value itself is not printed, logging key presence/status, provider chains, and decision paths can aid attackers, leak deployment configuration, and increase risk if logs are broadly accessible.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document frames the skill as 'documentation' rather than an active code-modifying package, yet the installation steps instruct users to overwrite core Clawdbot runtime files under the global npm installation. That mismatch can mislead operators about the trust boundary and review required, increasing the chance that unvetted code changes are applied directly to production bot logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions tell users to copy replacement JavaScript files into the installed application directory, modifying executable core files in place. Even with backups, this bypasses normal package integrity and update controls, making it easy to introduce malicious or unsafe logic and harder to audit, detect, or safely maintain over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code forwards inbound message content and rich sender metadata to a global hook system via runMessageReceived without any visible consent, minimization, or policy gating at the call site. If hooks are provided by plugins or third parties, private user messages and identifiers can be exfiltrated or processed unexpectedly, creating a privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The defaults hard-code en-US-MichelleNeural and en-US, which imposes a specific language/locale choice by default. The file does not present this as an explicit user opt-in or region-specific requirement, so it conflicts with the language/locale policy criterion.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The code is designed to send text to an external OpenAI-compatible TTS endpoint, including arbitrary custom endpoints via OPENAI_TTS_BASE_URL. In this skill context, agent output can contain sensitive information, so outbound transmission to third-party or operator-defined endpoints is a genuine data exfiltration/privacy risk unless tightly disclosed and controlled.

Content

Scanner excerpt · patch/tts.js (reported line 583)May include surrounding context.

js

* When set, model/voice validation is relaxed to allow non-OpenAI models.
 * Example: OPENAI_TTS_BASE_URL=http://localhost:8880/v1
 */
const OPENAI_TTS_BASE_URL = (process.env.OPENAI_TTS_BASE_URL?.trim() || "https://api.openai.com/v1").replace(/\/+$/, "");
const isCustomOpenAIEndpoint = OPENAI_TTS_BASE_URL !== "https://api.openai.com/v1";
export const OPENAI_TTS_VOICES = [
    "alloy",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · patch/tts.js (reported line 584)May include surrounding context.

js

* Example: OPENAI_TTS_BASE_URL=http://localhost:8880/v1
 */
const OPENAI_TTS_BASE_URL = (process.env.OPENAI_TTS_BASE_URL?.trim() || "https://api.openai.com/v1").replace(/\/+$/, "");
const isCustomOpenAIEndpoint = OPENAI_TTS_BASE_URL !== "https://api.openai.com/v1";
export const OPENAI_TTS_VOICES = [
    "alloy",
    "ash",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code automatically sends message text to external TTS providers (OpenAI, ElevenLabs, or Edge/network-backed service) once checks pass, but there is no user-facing consent, disclosure, or data-classification gate here. In agent contexts, responses may contain sensitive user data, so silent transmission to third-party services creates a real privacy and compliance risk even if the functionality is intentional.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The testing instructions tell the user to copy patched files directly into the application's dist directories, which is a file-modifying operation affecting core files. A later revert section mentions backups conditionally, but there is no upfront warning in the apply step that this overwrites existing files and should be preceded by a backup.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: clawdbot has 11 known advisory(ies) (CVE-2026-26317 (OpenClaw affected by cross-site request forgery (CSRF) through loopback browser ); GHSA-chm2-m3w2-wcxm (OpenClaw Google Chat spoofing access with allowlist authorized mutable email pri); CVE-2026-26328 (OpenClaw iMessage group allowlist authorization inherited DM pairing-store ident) +8 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest declares a peer dependency on clawdbot using a broad range (>=1.0.0) instead of constraining to a known-safe release, so consumers may install versions affected by known advisories. In a bot extension that processes Discord voice/TTS features, inherited flaws in the host bot can expose the deployment to unrelated but real upstream compromise paths, and the lack of pinning makes exposure unverifiable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The module reads provider credentials from environment variables such as ELEVENLABS_API_KEY, XI_API_KEY, and OPENAI_API_KEY. This is a sensitive operation under the rule, and the file provides no docstring, comment, or user-visible notice explaining that external service credentials are accessed to perform TTS requests.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: patch/tts.js:144

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: patch/tts.js:894