Security audit

STT Recognizer | STT 识别器

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real speech-to-text skill, but it needs review because it can record and upload sensitive audio and its install/API guidance lacks important safeguards.

Review before installing. Prefer a virtual environment instead of --break-system-packages, pin or lock dependencies, avoid passing API keys on the command line, use only HTTPS API endpoints unless intentionally using localhost, and treat recordings/transcripts as sensitive files that remain on disk until deleted.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/transcribe.py:228
Finding: API Credential Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/transcribe.py:181
Finding: Sensitive Audio and Credentials Can Be Sent Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:6
Finding: Unpinned Dependencies Installed With System Package Protections Disabled
Content: View full analysis
=1.0.0 # Option 2: openai-whisper (full model, slower but accurate) # Note: Install ONLY one of faster-whisper or whisper, not both # whisper>=20231117 # ── Audio Recording ───────────────────────────────────────────────────────── # Option 1: PyAudio (cross-platform) pyaudio>=0.2.14 # Option 2: SoundDevice + SoundFile (alternative) # sounddevice>=0.4.5 # soundfile>=0.12.1 # ── API Support ──────────────────────────────────────────────────────────── # For OpenAI-compatible API transcription openai>=1.0.0 # ── Core ─────────────────────────────────────────────────────────────────── numpy>=1.24.0 torch>=2.0.0 ``` The documentation instructs users to bypass system package protections: ```bash cd ~/.openclaw/workspace/skills/stt-recognizer pip install -r requirements.txt --break-system-packages ``` ### Technical Analysis Every active dependency has only a lower version bound. Consequently, installation may resolve to any future release rather than a version that was reviewed with this Skill. This reduces reproducibility and expands exposure to compromised releases, malicious upstream changes, newly introduced vulnerabilities, and breaking behavior. The documented `--break-system-packages` option bypasses Python's externally managed environment protection. Packages may therefore replace or conflict with distribution-managed components in the system interpreter. The listed package names correspond to legitimate dependencies; the audit found no evidence that the project intentionally references typosquatted or malicious packages. The risk a ...[truncated 1365 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 代码块的核心功能是“录音并保存 WAV 文件”，这可以作为 STT 流程的前置步骤，但本身不是语音转文字工具的完整实现。声明中强调支持本地 Whisper 和云端 API 转写，而代码中没有导入或调用 faster-whisper、OpenAI 兼容接口、HTTP 请求库，也没有任何音频到文本的处理逻辑。因此，描述显著高于代码实际能力，属于用途与行为不一致。录音和设备列表属于声明中提到的支持性部分，但不足以支撑‘语音转文字’这一主要功能声明。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents shell commands, environment-variable use, file creation, and persistent storage behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens user and platform visibility into what the skill may access or modify, increasing the chance of over-broad execution and accidental misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill captures microphone audio and stores recordings and transcriptions persistently, but the description lacks a clear upfront privacy warning. Users may invoke it without realizing sensitive speech will be recorded and retained on disk, which can expose credentials, private conversations, or regulated data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The API transcription mode sends audio to a remote service, but the documentation does not explicitly warn that user speech may leave the local machine. In a speech-processing skill, this materially changes the privacy and trust model and can expose sensitive spoken data to third parties.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This example documents use of a remote API endpoint for transcription, which entails external transmission of user audio and potentially derived text. In the context of an STT skill, external transmission is expected functionality, but it is still security-relevant because spoken content may be sensitive.
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
使用 API 转写

python3 scripts/transcribe.py audio.wav
--engine api
--api-url https://api.openai.com/v1
--api-key sk-xxx
--model whisper-1

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The environment-variable example configures a remote transcription service, again enabling external transfer of user audio and possibly transcripts. Although consistent with the declared cloud mode, it is dangerous without clear consent and privacy disclosure because the skill handles microphone-derived data.
Content: Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.
API 模式设置示例:

bash
export STT_API_URL=https://api.openai.com/v1 export STT_API_KEY=sk-your-key

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.
bash
# Ubuntu/Debian sudo apt-get install portaudio19-dev libasound-dev # macOS brew install portaudio

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.
bash
# Ubuntu/Debian sudo apt-get install portaudio19-dev libasound-dev # macOS brew install portaudio

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/record_audio.py (reported line 127)May include surrounding context.
python
] # Use subprocess.run with shell=False to prevent shell injection via output_path try: subprocess.run(cmd, check=True, capture_output=True) print(f" Saved: {output_path}") except subprocess.CalledProcessError as e: print(f"ERROR: arecord failed with code {e.returncode}", file=sys.stderr)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/record_audio.py (reported line 186)May include surrounding context.
python
print(sd.query_devices()) else: # Try using arecord -l result = subprocess.run(['arecord', '-l'], capture_output=True, text=True) if result.returncode != 0: print('No arecord available') else:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When the API engine is used, the script uploads the full audio file to a remote OpenAI-compatible endpoint, but the code provides only generic logging and no explicit privacy warning or confirmation that data will leave the local machine. In an STT skill, audio may contain highly sensitive speech, so silent transmission to arbitrary configured endpoints creates a meaningful confidentiality risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes the skill as a speech-to-text recognizer/transcription tool, but the CLI explicitly exposes a 'translate' task and the transcription backends implement translation behavior. Translation changes the semantic function from transcription to cross-language transformation, which is broader than plain STT.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The --task help text states that translate means translation 'to English', which imposes a specific output language choice in the skill's natural-language interface. This is a locale/language policy issue because the user is not offered a language choice or explicit opt-in beyond selecting a generic translation task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language display name includes both English and Chinese variants separated by a pipe, which imposes a specific locale presentation choice in metadata without any indication of user preference, opt-in, or region-specific justification. This may violate language/locale policy where skills must not force a particular language presentation absent user choice.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified with a minimum version only, so installs are not reproducible and may pull in newer releases with undiscovered or incompatible behavior. In a speech-to-text skill, this increases supply-chain and stability risk, though the file itself does not indicate an actively malicious package choice.
Content: Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.
text
# ── Core STT Engines ──────────────────────────────────────────────────────── # Option 1: faster-whisper (recommended - GPU/CPU efficient) faster-whisper>=1.0.0 # Option 2: openai-whisper (full model, slower but accurate) # Note: Install ONLY one of faster-whisper or whisper, not both

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: Using an unpinned PyAudio version allows different environments to install different releases, which can introduce vulnerable or breaking versions without notice. This is a low-severity supply-chain hygiene issue rather than a direct exploitable flaw in the requirements file itself.
Content: Scanner excerpt · requirements.txt (reported line 14)May include surrounding context.
text
# ── Audio Recording ───────────────────────────────────────────────────────── # Option 1: PyAudio (cross-platform) pyaudio>=0.2.14 # Option 2: SoundDevice + SoundFile (alternative) # sounddevice>=0.4.5

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The OpenAI client library is unpinned, which means dependency resolution may select any newer version above the minimum. For a skill that can send audio to a cloud API, uncontrolled upgrades raise supply-chain and operational risk, even if no immediate exploit is visible here.
Content: Scanner excerpt · requirements.txt (reported line 22)May include surrounding context.
text
# ── API Support ──────────────────────────────────────────────────────────── # For OpenAI-compatible API transcription openai>=1.0.0 # ── Core ─────────────────────────────────────────────────────────────────── numpy>=1.24.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: NumPy is unpinned, so builds are non-reproducible and may resolve to versions with known defects or future regressions. Because this is a foundational package with a history of advisories, leaving it unconstrained increases uncertainty about deployed risk.
Content: Scanner excerpt · requirements.txt (reported line 25)May include surrounding context.
text
openai>=1.0.0 # ── Core ─────────────────────────────────────────────────────────────────── numpy>=1.24.0 torch>=2.0.0 # ── Platform-specific ──────────────────────────────────────────────────────

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: The finding is valid because numpy has known advisories and the manifest does not pin a version, making it impossible to verify whether an installed version is affected. In this STT context the requirements file alone does not prove exploitability, but it does leave a real unresolved dependency-risk gap.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Torch is unpinned, creating non-deterministic installs for a large, security-relevant package with prior high-impact advisories. In ML tooling, unreviewed upgrades can materially expand attack surface or expose vulnerable code paths, making this somewhat more concerning than ordinary library drift.
Content: Scanner excerpt · requirements.txt (reported line 26)May include surrounding context.
text
# ── Core ─────────────────────────────────────────────────────────────────── numpy>=1.24.0 torch>=2.0.0 # ── Platform-specific ────────────────────────────────────────────────────── # Linux: for ALSA audio recording

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: This is a real issue because torch has multiple known advisories and the unpinned requirement prevents verification that deployed installations are safe. Given PyTorch's history of serious issues, including code-execution-related cases, the lack of version control is more dangerous in an ML-focused skill than in a minimal utility package.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script accepts STT_API_KEY from the environment and --api-key from the command line, but provides no warning or documentation about handling sensitive credentials. For safety-sensitive operations involving secrets, the file should disclose that credentials are being consumed and recommend safer usage patterns.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp2

Tp4

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

External Transmission

使用 API 转写

External Transmission

Sudo/Root Execution

Sudo/Root Execution

subprocess module call

subprocess module call

Missing User Warnings

Description-Behavior Mismatch

Natural-Language Policy Violations

Natural-Language Policy Violations

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Missing User Warnings

Static analysis