Jetson CUDA Voice Pipeline

• Analyzed: May 11, 2026, 4:42 AM
• Findings: 1
• Version: 1.1.0
• Hash: 9a58329968ed882d5378634860f9760fce1e854cf1c212f7855d0ee30062758d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several vulnerabilities and risky operations, though without clear evidence of intentional malice. Key concerns include: 1) Potential for shell injection in `pipeline/manage.sh` and `pipeline/setup.sh` if environment variables or script arguments are manipulated by an attacker (e.g., via prompt injection to the OpenClaw agent). 2) The `OPENROUTER_API_KEY` is stored in plain text within the systemd service file (`~/.config/systemd/user/voice-pipeline.service`), posing an information disclosure risk. 3) The `SKILL.md` and `setup.sh` (as a tip) instruct the user to execute `sudo` commands to modify system-wide udev rules, which is a privileged operation, even if for a stated hardware fix. While the skill performs remote downloads and network calls, these are from legitimate sources (Hugging Face, OpenRouter) and for the stated purpose of the voice assistant.