ClawHub
Back to skill

Security audit

Faster Whisper Local Service

Security checks for vulnerabilities and agentic risk

Overview

This skill sets up a disclosed local speech-to-text service, with normal but important install-time risks from a persistent user service and downloaded Python dependencies.

Install only if you want a persistent local transcription server. Review any environment variables before running deploy.sh, expect a Hugging Face model download and pip dependency installation, and use the documented systemctl commands if you later want to disable the service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/deploy.sh:34
Finding

Unescaped Configuration Injection into Generated Python and systemd Files

Content
View full analysis
"$VOICE_DIR/transcribe-server.py" < "$SERVICE_FILE" <
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/deploy.sh:31
Finding

Unpinned Installer and Unlocked Transitive Dependencies

Content
View full analysis
/dev/null "$VENV/bin/pip" install "faster-whisper==${FW_VERSION}" >/dev/null ``` ### Technical Analysis The deployment upgrades pip to the latest version available at installation time and installs faster-whisper without artifact hashes or a fully locked transitive dependency set. Although faster-whisper defaults to version `1.1.1`, its dependencies and the pip installer itself are resolved from mutable package-index state. The `FASTER_WHISPER_VERSION` override is also accepted without an allowlist, allowing deployment automation or an untrusted environment to select another available release. No evidence of an intentionally malicious package or typosquatted dependency was found, but the installation process is not reproducible and unnecessarily expands supply-chain risk. ### Attack Path 1. A user runs `scripts/deploy.sh` while connected to the configured Python package index. 2. The script downloads the current pip release and resolves faster-whisper dependencies at that time. 3. A compromised index, compromised upstream release, unsafe index configuration, or unexpected transitive release supplies altered package artifacts. 4. Package installation code or subsequently imported package code executes under the deploying user's account. 5. The installed package remains part of the persistent transcription service environment. ### Impact Assessment A compromised dependency can execute with the privileges of the deploying user during installation or when the service imports and runs it. This could expose user-readable data, alter files and user services, or compromise transcription data. The reviewed script does not establish root execution, so the demonstrated privilege scope is limited to the deployin ...[truncated 73 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/status.sh:5
Finding

Predictable Shared Temporary File Enables Local File Clobbering

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

bash
systemctl --user stop openclaw-transcribe.service
systemctl --user disable openclaw-transcribe.service
rm -f ~/.config/systemd/user/openclaw-transcribe.service
systemctl --user daemon-reload

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

Optional full cleanup:

bash
rm -rf ~/.openclaw/workspace/.venv-faster-whisper
rm -f ~/.openclaw/workspace/voice-input/transcribe-server.py

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

Optional full cleanup:

bash
rm -rf ~/.openclaw/workspace/.venv-faster-whisper
rm -f ~/.openclaw/workspace/voice-input/transcribe-server.py

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

bash
rm -rf ~/.openclaw/workspace/.venv-faster-whisper
rm -f ~/.openclaw/workspace/voice-input/transcribe-server.py

Verify

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
|---|---|---|
| Python venv | `$WORKSPACE/.venv-faster-whisper/` | Creates venv, installs faster-whisper via pip |
| Transcribe server | `$WORKSPACE/voice-input/transcribe-server.py` | Writes server script |
| Systemd service | `~/.config/systemd/user/openclaw-transcribe.service` | Creates + enables persistent service |
| Model cache | `~/.cache/huggingface/` | Downloads model weights on first run |

## Uninstall

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The script installs and enables a persistent user-level systemd service that automatically restarts and survives beyond the initial deployment. Persistence is security-relevant because it creates a long-lived local HTTP transcription server and background process, increasing the attack surface and making unintended or malicious behavior continue across sessions until manually removed.

Content

Scanner excerpt · scripts/deploy.sh (reported line 152)May include surrounding context.

sh
UNIT

systemctl --user daemon-reload
systemctl --user enable --now openclaw-transcribe.service
systemctl --user restart openclaw-transcribe.service

echo "deploy:ok workspace=${WORKSPACE} model=${MODEL_SIZE} port=${TRANSCRIBE_PORT}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/status.sh (reported line 5)May include surrounding context.

sh
set -euo pipefail

systemctl --user is-active openclaw-transcribe.service
curl -s -o /tmp/fws-health.json -w 'http:%{http_code}\n' http://127.0.0.1:18790/transcribe -X POST -H 'Content-Type: application/octet-stream' --data-binary 'x'
head -c 200 /tmp/fws-health.json || true
echo

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:101