ClawHub
Back to skill

Security audit

Whisper Stt

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly straightforward Whisper speech-to-text helper, but it instructs automatic forwarding of transcripts to Feishu without clear destination, consent, or implementation details.

Review this skill before installing if your audio may contain private, business, medical, legal, or regulated information. Use it only if you are comfortable with transcript forwarding to Feishu or can remove/disable that instruction, and install dependencies in a pinned virtual environment where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:32
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Generate and verify cryptographic hashes using a reproducible dependency-management process. Install with hash enforcement where practical: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Maintain a lock file produced by a tool such as `pip-tools`, and review dependency updates before changing locked versions. 4. Install dependencies in a dedicated virtual environment rather than the system Python environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Update all installation examples in `README.md`, `README-CN.md`, and `transcribe.py` so they reference the same pinned dependency file. 6. Document the expected official package index and discourage installation from untrusted mirrors or alternate package sources. 7. Consider verifying downloaded Whisper model artifacts through the integrity mechanisms supported by the upstream library, because `whisper.load_model()` downloads model data on first use. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README-CN.md (reported line 31)May include surrounding context.

macOS

brew install ffmpeg

Ubuntu

sudo apt install ffmpeg

Windows

winget install ffmpeg

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

macOS

brew install ffmpeg

Ubuntu

sudo apt install ffmpeg

Windows

winget install ffmpeg

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README-CN.md (reported line 129)May include surrounding context.

md
安装 FFmpeg：
- macOS: `brew install ffmpeg`
- Ubuntu: `sudo apt install ffmpeg`

### "模型下载太慢"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description says audio will be transcribed and the resulting text sent to Feishu, but it does not clearly warn users that potentially sensitive spoken content will leave the transcription context and be transmitted onward. This is a privacy and data-handling risk, especially because speech may contain personal, confidential, or regulated information that users would not expect to be forwarded automatically.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation claims the skill will automatically send transcribed text to Feishu, but the example implementation only performs local transcription and prints the result. This mismatch is dangerous because operators and users may assume a data flow to Feishu exists without seeing how authentication, authorization, privacy handling, or destination controls are implemented, leading to insecure deployment or unnoticed data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The call to transcribe uses language="zh", which forces a specific language/locale behavior for all users. The file does not provide an opt-in, a CLI flag to select language, or documentation that this restriction is intentionally limited to a region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

文档在示例中说明“首次使用会下载”，表明技能会进行网络访问并下载模型文件，但 README 未在使用说明或警示位置明确提醒用户这一行为可能消耗带宽、磁盘空间和时间。对于会触发外部下载的技能，提供简短用户提示有助于避免意外的数据传输和资源占用。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.