Volcengine STT

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:22 AM UTC
• Version: 0.2.1

Overview

This transcription skill is broadly purpose-aligned, but its script uses different credentials, endpoints, and options than the user-facing documentation claims.

Review before installing. This is not evidence of malware, but users should know that the documented ARK configuration is inaccurate: audio may be uploaded to hardcoded ByteDance AUC endpoints using VOLC credentials, including credentials read from OpenClaw config. Install only if that destination, credential source, and billable usage model are acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/transcribe.sh:63
• Finding: Undisclosed Credential Fallback and Hardcoded API Destination Conflict with the Documented Security Contract## Vulnerability Details **File Location**: `SKILL.md:16-28, 37-44`; `scripts/transcribe.sh:63-73, 86-111` **Vulnerability Type**: Documentation and implementation mismatch causing unexpected credential and audio-data disclosure **Risk Level**: Medium The Skill documentation advertises an ARK-compatible transcription interface using `ARK_API_KEY`, a configurable `ARK_BASE_URL`, and `ARK_STT_MODEL`: ```markdown Default behavior: - Endpoint: `${ARK_BASE_URL:-https://ark.cn-beijing.volces.com/api/v3}/audio/transcriptions` - Model: `${ARK_STT_MODEL:-doubao-seed-asr-1-0}` - Auth header: `Authorization: Bearer $ARK_API_KEY` - Output file: `<input>.txt` ## Required env - `ARK_API_KEY` (required) Optional: - `ARK_BASE_URL` (default: `https://ark.cn-beijing.volces.com/api/v3`) - `ARK_STT_MODEL` (default: `doubao-seed-asr-1-0`) ``` The implementation instead retrieves Volcengine AUC credentials from environment variables or an OpenClaw configuration file: ```bash # Config fallback if [[ -z "$APP_ID" || -z "$ACCESS_TOKEN" ]]; then CFG="${OPENCLAW_CONFIG_PATH:-$HOME/.openclaw/openclaw.json}" if [[ -f "$CFG" ]] && command -v jq >/dev/null 2>&1; then [[ -z "$APP_ID" ]] && APP_ID="$(jq -r '.skills.entries["volcengine-stt"].appId // .skills.entries["volcengine-stt"].env.VOLC_APP_ID // .skills["volcengine-stt"].appId // .skills["volcengine-stt"].env.VOLC_APP_ID // empty' "$CFG")" [[ -z "$ACCESS_TOKEN" ]] && ACCESS_TOKEN="$(jq -r '.skills.entries["volcengine-stt"].accessToken // .skills.entries["volcengine-stt"].env.VOLC_ACCESS_TOKEN // .skills["volcengine-stt"].accessToken // .skills["volcengine-stt"].env.VOLC_ACCESS_TOKEN // empty' "$CFG")" CFG_RES="$(jq -r '.skills.entries["volcengine-stt"].resourceId // .skills.entries["volcengine-stt"].env.VOLC_RESOURCE_ID // .skills["volcengine-stt"].resourceId // .skills["volcengine-stt"].env.VOLC_RESOURCE_ID // empty' "$CFG")" ...[truncated 4350 chars]
• Remediation: ## Remediation Suggestions 1. Make the implementation conform to the documented interface by implementing `ARK_API_KEY`, `ARK_BASE_URL`, `ARK_STT_MODEL`, and the documented `--prompt` option; alternatively, rewrite `SKILL.md` to accurately describe the AUC API, variables, headers, modes, and destinations. 2. Avoid silently reading credentials from `~/.openclaw/openclaw.json`. Require explicit opt-in through a flag or configuration setting before using the fallback. 3. Clearly disclose that the complete audio file and authentication headers are transmitted to `openspeech.bytedance.com`. 4. Provide a configurable endpoint with a secure default, validate it against an administrator-controlled HTTPS allowlist, and reject non-HTTPS URLs. 5. Fail closed when documented and actual configuration modes conflict. Do not silently substitute one API provider or authentication scheme for another. 6. Validate the selected mode, resource ID, polling interval, and timeout before making any request. 7. Use credentials with the minimum required API scope, rotate credentials that may have been used under incorrect assumptions, and apply provider-side quota and billing limits. 8. Add automated tests verifying that documentation examples map to supported options, expected credential sources, and the actual network destination. 9. Present an explicit confirmation or policy hook before uploading potentially sensitive recordings when the destination has not previously been approved.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents execution of a shell script but does not declare any tool scope such as permissions or allowed-tools. In agent environments, this can cause the skill to run with broader shell access than intended, increasing the risk of command execution misuse or unsafe composition with untrusted inputs. The risk is elevated because the skill is specifically designed to invoke a local script on user-supplied audio paths and may be called by other agents.

External Transmission

Medium

• Category: Data Exfiltration

Content

else
    jq -n --arg app "$APP_ID" --arg data "$AUDIO_B64" --arg fmt "$format" '{user:{uid:$app},audio:{data:$data,format:$fmt,codec:"opus"},request:{model_name:"bigmodel",enable_itn:true,enable_punc:true}}' > "$TMP_REQ"
  fi
  curl -sS "$ENDPOINT" "${HEADERS[@]}" -d @"$TMP_REQ" -D "$TMP_H" -o "$TMP_RES"
else
  SUBMIT="https://openspeech.bytedance.com/api/v3/auc/bigmodel/submit"
  QUERY="https://openspeech.bytedance.com/api/v3/auc/bigmodel/query"

• Confidence: 96% confidence
• Finding: This network call uploads the full audio payload to an external API endpoint for processing. In the context of a transcription skill this is functional behavior rather than covert malware, but it is still security-relevant because sensitive recordings may leave the local environment and be processed by a third party.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script base64-encodes the local audio file and sends it, along with API credentials in headers, to a third-party remote service. That behavior is expected for an STT integration, but it is still a real data-exfiltration/privacy risk because the script provides no explicit user-facing notice or consent checkpoint before transmitting potentially sensitive voice content off-host.

External Transmission

Medium

• Category: Data Exfiltration

Content

start_ts="$(date +%s)"
  while :; do
    echo '{}' > "$TMP_REQ"
    curl -sS "$QUERY" "${HEADERS[@]}" -d @"$TMP_REQ" -D "$TMP_H" -o "$TMP_RES"
    q_code="$(grep -i '^X-Api-Status-Code:' "$TMP_H" | awk '{print $2}' | tr -d '\r' || true)"
    if [[ "$q_code" == "20000000" ]]; then
      break

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.