other
Warning
- Location
- scripts/download_transcribe.py:15
- Finding
- Automatic Disclosure of Extracted Audio to an External Transcription Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download_transcribe.py:15-31` **Vulnerability Type**: Privacy-sensitive external data transfer **Risk Level**: Medium ### Vulnerable Code ```python key = os.environ.get('OPENAI_API_KEY') if key: import mimetypes, uuid boundary = '----openclaw' + uuid.uuid4().hex body = [] def part(name, value, filename=None, ctype='text/plain'): body.append(f'--{boundary}\r\n'.encode()) if filename: body.append(f'Content-Disposition: form-data; name="{name}"; filename="{filename}"\r\nContent-Type: {ctype}\r\n\r\n'.encode()); body.append(value); body.append(b'\r\n') else: body.append(f'Content-Disposition: form-data; name="{name}"\r\n\r\n{value}\r\n'.encode()) part('model', 'gpt-4o-mini-transcribe') part('response_format', 'json') part('file', audio.read_bytes(), audio.name, 'audio/wav') body.append(f'--{boundary}--\r\n'.encode()) req = urllib.request.Request('https://api.openai.com/v1/audio/transcriptions', data=b''.join(body), headers={'Authorization': f'Bearer {key}', 'Content-Type': f'multipart/form-data; boundary={boundary}'}) with urllib.request.urlopen(req, timeout=180) as r: data = json.loads(r.read().decode()) ``` ### Technical Analysis When `OPENAI_API_KEY` is present in the process environment, the script automatically reads the complete extracted audio file into memory and sends it to the OpenAI transcription API. The behavior is triggered solely by the presence of the environment variable; there is no explicit command-line option, interactive confirmation, or per-execution consent requirement. Although the skill documentation requests transcription, it does not state that the media will be disclosed to an external service. This creates a privacy and data-governance risk when the downloaded media contains private conversations, confidential business information, personal data, or copyrighted material. Th ...[truncated 1261 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require an explicit option such as `--use-openai` before sending any content to the API. 2. Display or document the destination service, the type of data transmitted, and the applicable privacy implications. 3. Do not treat the mere presence of `OPENAI_API_KEY` as consent to upload data. 4. Consider requiring an additional confirmation flag such as `--confirm-external-upload` for non-interactive execution. 5. Provide an offline transcription mode where feasible. 6. Validate API responses and handle HTTP and JSON errors without exposing credentials or sensitive response data. 7. Update `SKILL.md` to clearly disclose that external transcription uploads the extracted audio and may incur API charges. ]]>