mano-asr

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:55 AM UTC
• Version: 1.0.1

Overview

This skill is mostly a coherent local transcription setup, but its optional cloud fallback can send voice data to OpenAI without clearly warning users despite strong offline-privacy claims.

Before installing, treat the default local-only configuration as the privacy-preserving path. Avoid the OpenAI fallback unless you accept that failed local transcription may route voice content or derived transcription data to a cloud provider. Review the Homebrew tap and mano-asr release provenance, and prefer pinned, verified releases where available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–45
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

brew tap Mininglamp-AI/tap
brew install mano-asr

The installed executable is subsequently invoked, including at SKILL.md:78:

bash

mano-asr start

Technical Analysis

The installation instructions add a third-party Homebrew tap and install its mano-asr package without pinning an immutable version, formula revision, commit, signature, or expected artifact checksum. The resulting executable is then run with the invoking user's privileges. Its startup process is also documented as automatically downloading an ASR model.

Although the tap's organization name is consistent with the declared upstream project, the retrieved formula and artifacts remain mutable after this Skill has been reviewed. Consequently, a compromise of the tap, upstream release infrastructure, maintainer account, or distribution artifact could turn these documented commands into a supply-chain code-execution path.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, the upstream release infrastructure, or a referenced package artifact.
2. The attacker modifies the formula or distributed artifact to include malicious code.
3. A user follows the Skill's instructions and runs brew tap Mininglamp-AI/tap and brew install mano-asr.
4. Homebrew retrieves and installs the altered dependency because the instructions provide no immutable version or independently verified checksum.
5. The user runs mano-asr start, or OpenClaw invokes the installed mano-asr CLI during transcription.
6. The malicious payload executes locally with the permissions of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The atta ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mano-asr to a reviewed release and an immutable Homebrew formula revision or repository commit.
• Publish and verify expected SHA-256 checksums for downloaded release artifacts and model files.
• Prefer signed releases and document signature verification against a trusted maintainer key.
• Review the third-party formula and all URLs it references before installation.
• Avoid relying on a mutable tap head or automatically changing artifact location.
• Run the transcription component with least privilege and restrict its access to only the required model directory and temporary audio files.
• Document that users should re-verify hashes and signatures before upgrades rather than automatically trusting newly published versions.
• If automatic model retrieval cannot be eliminated, pin the model identifier and revision and verify its integrity before loading it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide presents a 'local-first + cloud fallback' transcription setup immediately after emphasizing offline privacy, but it does not clearly warn that fallback to OpenAI sends audio content off-device to a third party. This can mislead users into enabling a configuration that undermines the stated privacy model and may expose sensitive voice data without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.