ClawHub
Back to skill

Security audit

stt

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real speech-to-text helper, but it can upload any readable local file path to a third-party API instead of limiting itself to verified audio files.

Install only if you are comfortable sending selected audio to SkillBoss API Hub and you can control which paths agents pass to the script. Avoid using it on confidential recordings until it validates supported audio formats, rejects non-regular or oversized files, and clearly warns before uploading sensitive content.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
transcribe.py:47
Finding

Unrestricted Local File Upload to External Transcription Service

Content
View full analysis
Remediation
View remediation
MAX_AUDIO_SIZE: raise RuntimeError("Audio file exceeds the maximum allowed size") ``` 5. Where operationally possible, restrict input paths to approved media directories and reject paths that resolve outside those directories. 6. Clearly notify users that the selected file will be sent to an external service. For interactive use, consider requiring confirmation before uploading files outside a designated media directory. 7. Avoid keeping more copies of the file in memory than necessary. If supported by the remote API, use bounded or streaming uploads. 8. Add tests confirming rejection of unsupported extensions, non-regular files, oversized files, path traversal outside approved directories, and files with invalid audio signatures. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from os.environ.get (line 82, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · transcribe.py (reported line 87)May include surrounding context.

python
data=json.dumps(payload).encode("utf-8"),
            headers=headers,
        )
        with urllib.request.urlopen(req) as response:
            result = json.loads(response.read().decode("utf-8"))
            return result["result"]["text"]
    except urllib.error.HTTPError as e:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares that it uses an environment variable and transmits data to a remote API, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that users or orchestration frameworks will invoke a network-capable skill without clear consent or policy enforcement, especially since it also relies on sensitive credential material from the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documentation explains how to transcribe local audio but does not clearly warn that the audio contents are uploaded to an external third-party API service. Because audio may contain sensitive personal, business, or authentication information, users may unknowingly exfiltrate private data outside their local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill exfiltrates user-provided audio content to an external third-party service for transcription. While this is core to the skill's functionality rather than obviously malicious behavior, it creates a real confidentiality and privacy risk because potentially sensitive audio is transmitted off-host to a remote vendor.

Content

Scanner excerpt · transcribe.py (reported line 24)May include surrounding context.

python
import urllib.error
import urllib.request

API_BASE = "https://api.heybossai.com/v1"

SUPPORTED_EXTENSIONS = {
    ".ogg": "audio/ogg",

Static analysis

No suspicious patterns detected.