Security audit

Oasis Audio Pro

Security checks for vulnerabilities and agentic risk

Overview

This audio skill is purpose-aligned, but it needs review because it can read broad local conversation, memory, and profile data before sending a derived prompt to xplai.ai.

Install only if you are comfortable with the skill reading recent OpenClaw/QClaw sessions, memory files, and USER.md for personalization and sending a derived prompt to xplai.ai. Use dry-run previews, avoid --audit and --debug for sensitive content, and treat generated prompts as potentially containing inferred personal details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The helper persists a JWT token to ~/.oasis_audio/oasis_config.json, which expands the skill's local behavior beyond the description emphasizing read-only access to existing local files for personalization. Storing bearer tokens on disk creates credential exposure risk if local files are accessible to other users, included in backups, or read by other tools, and it also weakens the transparency promised in the skill metadata.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The CLI advertises --refresh as forcing a refresh and ignoring the cached token, but the implementation still calls get_or_refresh_token(), which returns the cached token when one exists. This is primarily a security-relevant integrity issue: operators may believe they rotated credentials or invalidated a stale token when they did not, leading to continued use of an old credential.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The function writes the full composed prompt to a local audit log, which can include personalized or sensitive user-derived content. Even if the API transmission is constrained, local persistence expands the data exposure surface, can outlive user expectations, and may contradict the skill description's privacy boundary claims.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The consent notice promises that sensitive outgoing text will not be logged or sent until explicit confirmation, but the implementation treats `--allow-sensitive` as sufficient without any enforced review artifact or second-step confirmation flow. This creates a mismatch between user-facing assurances and actual behavior, increasing the risk of accidental disclosure of sensitive content to both local logs and the remote API.

Vague Triggers

Medium

Confidence: 70% confidence
Finding: The instruction to use the skill whenever audio 'would add value' creates an ambiguous activation boundary for a tool that reads local session history and may send derived content to a third party. In context, this increases the chance of collecting and processing personal data without a sufficiently specific user request, which can undermine meaningful consent.

Vague Triggers

Medium

Confidence: 70% confidence
Finding: The instruction to use the skill whenever audio 'would add value' creates an ambiguous activation boundary for a tool that reads local session history and may send derived content to a third party. In context, this increases the chance of collecting and processing personal data without a sufficiently specific user request, which can undermine meaningful consent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code silently writes a JWT token to a local file without any user-facing notice or consent flow. Even if the token is only for a visitor session, undisclosed credential storage is risky because users may not realize sensitive authentication material is being persisted and could remain on disk after use.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When DEBUG is enabled, the code prints full request JSON bodies or query parameters without any masking or field allowlisting. In this skill, requests may contain personalized content derived from local session or memory files, so debug output can leak sensitive prompts or user-derived data into console logs, terminals, CI output, or log aggregators.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When DEBUG is enabled, the code prints complete response bodies, which can expose returned transcripts, generated audio metadata, API error details, or echoed user content. Because this skill handles personalized narration inputs and may interact with an external API, response logging increases the chance that sensitive or private material is disclosed through local logs.

Ssd 3

High

Confidence: 95% confidence
Finding: The code intentionally aggregates recent conversation fragments, daily memory notes, and profile data from local session/memory stores into one JSON output. Even if later components claim to sanitize or require confirmation before remote transmission, this collector materially increases the risk of sensitive personal data being exposed to downstream prompts, logs, other tools, or external APIs because it centralizes and returns raw user-derived content.

Static analysis

No suspicious patterns detected.