claw-voice-local

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:02 AM UTC
• Version: 1.0.3

Overview

This skill performs the intended text-to-Telegram voice workflow, but its repeated offline/no-internet claims conflict with its actual Telegram API upload behavior and credential use.

Review this before installing if you expected a local-only skill. The TTS generation is local, but sending a Telegram voice note requires internet access and sends the generated audio plus chat ID to Telegram using your bot token. Use a dedicated Telegram bot token, restrict the target chat ID, verify Piper downloads yourself, and avoid allowing agents to choose arbitrary output paths unless overwrites are acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:46

Finding

Downloaded Piper Executable Is Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

piper_linux_x86_64.tar.gz" | sha256sum --check --strict - tar -xzf piper_linux_x86_64.tar.gz ``` 3. Obtain expected hashes from a separately authenticated source maintained by the project rather than deriving them from the downloaded archive itself. 4. Verify an upstream cryptographic release signature when one is available. 5. Prefer a distribution package protected by the operating system's signed package metadata where practical. 6. Extract into a new temporary directory and validate the expected archive layout before copying files. 7. Install and run Piper as an unprivileged user; do not execute the installation or Skill as root. 8. Pin both the release version and expected digest so a replaced asset at the same URL cannot silently change the executed code. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description claims operation 'without internet connectivity' while the skill explicitly requires a Telegram bot token and sends messages via Telegram, which necessarily involves outbound network access. This mismatch is security-relevant because it can mislead operators into approving or deploying a skill under false assumptions about isolation and exfiltration risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims operation 'without internet connectivity' while the skill explicitly requires a Telegram bot token and sends messages via Telegram, which necessarily involves outbound network access. This mismatch is security-relevant because it can mislead operators into approving or deploying a skill under false assumptions about isolation and exfiltration risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description claims operation 'without internet connectivity' while the skill explicitly requires a Telegram bot token and sends messages via Telegram, which necessarily involves outbound network access. This mismatch is security-relevant because it can mislead operators into approving or deploying a skill under false assumptions about isolation and exfiltration risk.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · speak.py (reported line 75)May include surrounding context.

python

try:
        # Set up environment for piper shared libraries
        env = os.environ.copy()
        existing = env.get("LD_LIBRARY_PATH", "")
        env["LD_LIBRARY_PATH"] = f"{PIPER_LIBS}:{existing}" if existing else str(PIPER_LIBS)
        espeak_data = MODEL_DIR / "espeak-ng-data"

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

The output path is taken from user input and passed to ffmpeg without validation, allowing arbitrary file writes within the permissions of the running user. Combined with forced overwrite, an attacker or unsafe workflow could redirect output to sensitive or important files, causing data loss or clobbering application state.

Content

Scanner excerpt · speak.py (reported line 96)May include surrounding context.

python

)

        # ffmpeg: WAV → OGG Opus (Telegram-compatible)
        subprocess.run(
            [
                "ffmpeg", "-y",
                "-i", str(wav_path),

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md

- Linux (x86_64 or ARM64 / Raspberry Pi)
- Python 3.11+
- [piper TTS binary](https://github.com/rhasspy/piper/releases) v1.2+
- ffmpeg (`sudo apt install ffmpeg`)
- A piper voice model (`.onnx`)
- Telegram bot token

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · speak.py (reported line 55)May include surrounding context.

python

- Linux (x86_64 or ARM64 / Raspberry Pi)
- Python 3.11+
- [piper TTS binary](https://github.com/rhasspy/piper/releases) v1.2+
- ffmpeg (`sudo apt install ffmpeg`)
- A piper voice model (`.onnx`)
- Telegram bot token

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

1. Install ffmpeg

bash

sudo apt install ffmpeg

2. Install piper binary

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

md

# Example: Linux ARM64 (Raspberry Pi)
wget https://github.com/rhasspy/piper/releases/download/v1.2.0/piper_linux_aarch64.tar.gz
tar -xzf piper_linux_aarch64.tar.gz
mkdir -p ~/.local/bin ~/.local/lib/piper
cp piper/piper ~/.local/bin/piper
cp piper/*.so* ~/.local/lib/piper/
chmod +x ~/.local/bin/piper

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises executable capabilities that include environment access, file reads, shell execution, and network use, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, missing scope declarations make it harder to enforce least privilege and can allow the skill to access sensitive tokens, local files, and outbound connectivity beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

## Config File

This skill reads `~/.openclaw/.env` as a fallback for credentials.
Ensure the file has restricted permissions: `chmod 600 ~/.openclaw/.env`

## Installation

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file header and skill framing present the capability as offline text-to-voice conversion, but the implementation chains into a Telegram sender script that transmits data externally. In an agent setting, deceptive or inaccurate capability descriptions are security-relevant because they can bypass user expectations, policy gating, and data-handling controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description emphasizes offline operation, but the code relies on TELEGRAM_BOT_TOKEN and sends content through Telegram, which is inherently networked and accesses sensitive credentials. This mismatch can mislead operators into granting secrets or approving execution under a lower-risk assumption than is warranted.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · say.py (reported line 70)May include surrounding context.

python

if args.model:
            speak_cmd += ["--model", args.model]

        subprocess.run(speak_cmd, check=True, capture_output=True, text=True)

        # Step 2: OGG → Telegram Voice Note
        subprocess.run(

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · say.py (reported line 73)May include surrounding context.

python

subprocess.run(speak_cmd, check=True, capture_output=True, text=True)

        # Step 2: OGG → Telegram Voice Note
        subprocess.run(
            [sys.executable, str(SEND), str(ogg), "--chat-id", chat_id],
            check=True
        )

Tainted flow: 'chat_id' from os.environ.get (line 55, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · say.py (reported line 73)May include surrounding context.

python

subprocess.run(speak_cmd, check=True, capture_output=True, text=True)

        # Step 2: OGG → Telegram Voice Note
        subprocess.run(
            [sys.executable, str(SEND), str(ogg), "--chat-id", chat_id],
            check=True
        )

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · send_voice.py (reported line 27)May include surrounding context.

python

"""Upload OGG file as Telegram voice message. Returns API response dict."""
    import urllib.request

    url = f"https://api.telegram.org/bot{bot_token}/sendVoice"
    boundary = "----ClawVoiceBoundary"

    def _field(name: str, value: str) -> bytes:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the skill should deliver Telegram voice notes "without internet connectivity," which implies an offline capability. In reality, the implementation constructs a Telegram API URL and sends the voice note via an HTTPS POST request, so successful message delivery requires internet access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · speak.py (reported line 53)May include surrounding context.

python

"  → Place the .onnx and .onnx.json files in ~/.local/share/piper/"
        )
    try:
        subprocess.run(["ffmpeg", "-version"], capture_output=True, check=True)
    except (FileNotFoundError, subprocess.CalledProcessError):
        errors.append("ffmpeg not found — install via: sudo apt install ffmpeg")
    if errors:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · speak.py (reported line 87)May include surrounding context.

python

if length_scale is not None:
            cmd += ["--length-scale", str(length_scale)]

        subprocess.run(
            cmd,
            input=text.encode("utf-8"),
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · speak.py (reported line 96)May include surrounding context.

python

)

        # ffmpeg: WAV → OGG Opus (Telegram-compatible)
        subprocess.run(
            [
                "ffmpeg", "-y",
                "-i", str(wav_path),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The ffmpeg command uses -y, which forces overwriting the destination file without confirmation. In an agent context where --output may be influenced by upstream workflow or user input, this can silently destroy existing files or replace expected content, especially because the default output is a predictable path in /tmp.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The README instructs users to download and install a prebuilt binary directly from the internet with wget, then extract and execute it locally. This creates a supply-chain risk: if the release artifact, hosting account, or transport path is compromised, users may install and run malicious code as part of the skill setup.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

bash

# Example: Linux ARM64 (Raspberry Pi)
wget https://github.com/rhasspy/piper/releases/download/v1.2.0/piper_linux_aarch64.tar.gz
tar -xzf piper_linux_aarch64.tar.gz
mkdir -p ~/.local/bin ~/.local/lib/piper
cp piper/piper ~/.local/bin/piper

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code performs an outbound HTTP POST to Telegram containing the contents of the specified OGG file and the target chat ID. Although the module docstring says it sends a voice note, the execution path itself has no confirmation prompt or user-facing disclosure before transmitting user data to an external service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The stated purpose focuses on converting text to offline Telegram voice messages using local TTS. Reading bot tokens and chat IDs from environment variables introduces credential and configuration access that is not part of text conversion itself and is not explicitly declared in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.