ClawHub

Funasr Transcribe Skill

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a local audio transcription helper whose filesystem writes and persistent environment are purpose-aligned and disclosed, though users should understand those side effects before installing.

Before installing, review install.sh and confirm you are comfortable with dependency/model downloads and a persistent environment under ~/.openclaw/workspace. When transcribing, use audio files you intend to process and check where the generated .txt transcript will be written.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises that it writes transcripts to local sibling .txt files, but its metadata declares no required permissions. That mismatch can cause an agent or user to authorize and invoke the skill without understanding that it will modify the filesystem, reducing transparency and consent around local file writes.

Session Persistence

Medium
Category
Rogue Agent
Content
## Quick Start

```bash
# Install dependencies and create a virtual environment
bash ~/.openclaw/workspace/skills/funasr-transcribe/scripts/install.sh

# Transcribe an audio file
Confidence
74% confidence
Finding
create a virtual environment bash ~/.openclaw/workspace/skills/funasr-transcribe/scripts/install.sh # Transcribe an audio file bash ~/.openclaw/workspace/skills/funasr-transcribe/scripts/transcribe.s

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal