whisperx

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:22 PM UTC
• Version: 1.0.0

Overview

This is a straightforward WhisperX transcription skill with disclosed local audio processing, package installation, and model caching, though users should note normal ML supply-chain and first-run download behavior.

Install this only if you are comfortable installing WhisperX and its dependencies from the Python package ecosystem. For stronger control, use a pinned WhisperX version in an isolated environment and expect first-run model downloads into the local Whisper cache before offline transcription works.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-11 and 34-40
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Code Snippet:

yaml

metadata:
  {
    "openclaw":
      {
        "emoji": "🎙️",
        "requires": { "bins": ["python3", "ffmpeg"] },
        "install": ["pip install whisperx"],
      },
  }

bash

# Install WhisperX
pip install whisperx
# or using uvx:
uvx whisperx

Technical Analysis

The skill instructs OpenClaw and users to resolve whisperx from a third-party package repository without an exact version, lockfile, or integrity hash. Consequently, installation is not reproducible, and the installed implementation can change after this skill has been reviewed.

The uvx whisperx alternative is particularly sensitive because it resolves and executes the package without providing an opportunity to verify a pinned artifact in the documented workflow. Although the audited skill contains no malicious executable code and there is no evidence that the current whisperx package is malicious, compromise of the package, its distribution account, package index, or a transitive dependency could turn this installation step into arbitrary code execution.

Attack Path

1. An attacker compromises the upstream whisperx release process, distribution account, package source, or one of its unpinned transitive dependencies.
2. The attacker publishes a package release containing malicious installation or runtime behavior.
3. A user or OpenClaw follows the skill metadata or installation documentation and runs pip install whisperx or uvx whisperx.
4. The package resolver retrieves the attacker-controlled release because the skill does not constrain the version or verify an artifact hash.
5. Installation or execution runs the malicious code with the privileges and environmental access of the invoking user.

Impact A

...[truncated 562 chars]

Remediation

View remediation

Remediation Suggestions

• Pin whisperx to an exact, reviewed version rather than resolving the latest release.
• Maintain a dependency lockfile that also constrains transitive dependencies.
• Require cryptographic hashes for downloaded distributions, such as with a hash-locked requirements file and pip --require-hashes.
• Retrieve packages only from an explicitly configured and trusted package index.
• Replace the unpinned uvx whisperx example with execution of an exact reviewed version in an isolated environment.
• Run transcription with least privilege and restrict filesystem, credential, and network access where practical.
• Establish a controlled update process that reviews and tests dependency changes before updating pins and hashes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documentation recommends running uvx whisperx without pinning a specific version, which can cause users to fetch and execute whatever package version is current at install time. That creates a supply-chain risk: a compromised upstream release or unexpected breaking change could lead to arbitrary code execution or unsafe behavior on the user's system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill states that models are downloaded automatically to ~/.cache/whisper/ on first run, but it does not clearly warn users that execution may initiate network access and write potentially large files to local disk. While this is common for ML tooling, the absence of an explicit warning can undermine user expectations in an 'offline' skill and may have privacy, policy, or operational implications in restricted environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.