ClawHub
Back to skill

Security audit

Local fun-asr-nano powered by sherpa-onnx

Security checks for vulnerabilities and agentic risk

Overview

This looks like a speech-to-text skill, but it should be reviewed because it promises fully offline use while its runtime code downloads model files from ModelScope.

Install only if you are comfortable with first-run or runtime network access to download model files from ModelScope and local caching of those files. For sensitive or air-gapped use, prefer a version that prepackages or explicitly pre-stages the model, documents the source and cache path, pins versions, and verifies model integrity.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The skill claims to be fully offline and to require no network connection, but the associated behavior reportedly downloads model assets from ModelScope at runtime or setup time. This mismatch can mislead users and host systems into granting trust, enabling the skill in restricted environments, or violating privacy/network-isolation expectations.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill advertises fully offline local speech recognition, but it fetches the model from a remote repository at runtime via snapshot_download(). This creates a supply-chain and privacy risk, breaks the offline trust boundary users may rely on, and can cause unexpected network egress in environments where audio processing is expected to remain isolated.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Including network-based model retrieval in a skill whose stated purpose is offline audio transcription expands the attack surface beyond what users would reasonably expect. Even if the downloaded content is only model data, it introduces remote dependency risk, possible telemetry/network leakage, and weakens assurances for restricted or air-gapped environments.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The activation conditions are broad enough to trigger on many generic audio-related requests, which can cause the skill to activate unexpectedly. Overbroad triggering is risky because it may intercept unintended content, process sensitive audio unnecessarily, or override a more appropriate tool for the user's request.

Static analysis

No suspicious patterns detected.