Volcengine STT

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:22 AM UTC
• Version: 0.2.1

Overview

This transcription skill is broadly purpose-aligned, but its script uses different credentials, endpoints, and options than the user-facing documentation claims.

Review before installing. This is not evidence of malware, but users should know that the documented ARK configuration is inaccurate: audio may be uploaded to hardcoded ByteDance AUC endpoints using VOLC credentials, including credentials read from OpenClaw config. Install only if that destination, credential source, and billable usage model are acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/transcribe.sh:63

Finding

Undisclosed Credential Fallback and Hardcoded API Destination Conflict with the Documented Security Contract

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-28, 37-44; scripts/transcribe.sh:63-73, 86-111
Vulnerability Type: Documentation and implementation mismatch causing unexpected credential and audio-data disclosure
Risk Level: Medium

The Skill documentation advertises an ARK-compatible transcription interface using ARK_API_KEY, a configurable ARK_BASE_URL, and ARK_STT_MODEL:

markdown

Default behavior:
- Endpoint: `${ARK_BASE_URL:-https://ark.cn-beijing.volces.com/api/v3}/audio/transcriptions`
- Model: `${ARK_STT_MODEL:-doubao-seed-asr-1-0}`
- Auth header: `Authorization: Bearer $ARK_API_KEY`
- Output file: `<input>.txt`

## Required env

- `ARK_API_KEY` (required)

Optional:
- `ARK_BASE_URL` (default: `https://ark.cn-beijing.volces.com/api/v3`)
- `ARK_STT_MODEL` (default: `doubao-seed-asr-1-0`)

The implementation instead retrieves Volcengine AUC credentials from environment variables or an OpenClaw configuration file:

bash

# Config fallback
if [[ -z "$APP_ID" || -z "$ACCESS_TOKEN" ]]; then
  CFG="${OPENCLAW_CONFIG_PATH:-$HOME/.openclaw/openclaw.json}"
  if [[ -f "$CFG" ]] && command -v jq >/dev/null 2>&1; then
    [[ -z "$APP_ID" ]] && APP_ID="$(jq -r '.skills.entries["volcengine-stt"].appId // .skills.entries["volcengine-stt"].env.VOLC_APP_ID // .skills["volcengine-stt"].appId // .skills["volcengine-stt"].env.VOLC_APP_ID // empty' "$CFG")"
    [[ -z "$ACCESS_TOKEN" ]] && ACCESS_TOKEN="$(jq -r '.skills.entries["volcengine-stt"].accessToken // .skills.entries["volcengine-stt"].env.VOLC_ACCESS_TOKEN // .skills["volcengine-stt"].accessToken // .skills["volcengine-stt"].env.VOLC_ACCESS_TOKEN // empty' "$CFG")"
    CFG_RES="$(jq -r '.skills.entries["volcengine-stt"].resourceId // .skills.entries["volcengine-stt"].env.VOLC_RESOURCE_ID // .skills["volcengine-stt"].resourceId // .skills["volcengine-stt"].env.VOLC_RESOURCE_ID // empty' "$CFG")"

...[truncated 4350 chars]

Remediation

View remediation

Remediation Suggestions

1. Make the implementation conform to the documented interface by implementing ARK_API_KEY, ARK_BASE_URL, ARK_STT_MODEL, and the documented --prompt option; alternatively, rewrite SKILL.md to accurately describe the AUC API, variables, headers, modes, and destinations.
2. Avoid silently reading credentials from ~/.openclaw/openclaw.json. Require explicit opt-in through a flag or configuration setting before using the fallback.
3. Clearly disclose that the complete audio file and authentication headers are transmitted to openspeech.bytedance.com.
4. Provide a configurable endpoint with a secure default, validate it against an administrator-controlled HTTPS allowlist, and reject non-HTTPS URLs.
5. Fail closed when documented and actual configuration modes conflict. Do not silently substitute one API provider or authentication scheme for another.
6. Validate the selected mode, resource ID, polling interval, and timeout before making any request.
7. Use credentials with the minimum required API scope, rotate credentials that may have been used under incorrect assumptions, and apply provider-side quota and billing limits.
8. Add automated tests verifying that documentation examples map to supported options, expected credential sources, and the actual network destination.
9. Present an explicit confirmation or policy hook before uploading potentially sensitive recordings when the destination has not previously been approved.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents execution of a shell script but does not declare any tool scope such as permissions or allowed-tools. In agent environments, this can cause the skill to run with broader shell access than intended, increasing the risk of command execution misuse or unsafe composition with untrusted inputs. The risk is elevated because the skill is specifically designed to invoke a local script on user-supplied audio paths and may be called by other agents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This network call uploads the full audio payload to an external API endpoint for processing. In the context of a transcription skill this is functional behavior rather than covert malware, but it is still security-relevant because sensitive recordings may leave the local environment and be processed by a third party.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 95)May include surrounding context.

sh

else
    jq -n --arg app "$APP_ID" --arg data "$AUDIO_B64" --arg fmt "$format" '{user:{uid:$app},audio:{data:$data,format:$fmt,codec:"opus"},request:{model_name:"bigmodel",enable_itn:true,enable_punc:true}}' > "$TMP_REQ"
  fi
  curl -sS "$ENDPOINT" "${HEADERS[@]}" -d @"$TMP_REQ" -D "$TMP_H" -o "$TMP_RES"
else
  SUBMIT="https://openspeech.bytedance.com/api/v3/auc/bigmodel/submit"
  QUERY="https://openspeech.bytedance.com/api/v3/auc/bigmodel/query"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script base64-encodes the local audio file and sends it, along with API credentials in headers, to a third-party remote service. That behavior is expected for an STT integration, but it is still a real data-exfiltration/privacy risk because the script provides no explicit user-facing notice or consent checkpoint before transmitting potentially sensitive voice content off-host.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 114)May include surrounding context.

sh

start_ts="$(date +%s)"
  while :; do
    echo '{}' > "$TMP_REQ"
    curl -sS "$QUERY" "${HEADERS[@]}" -d @"$TMP_REQ" -D "$TMP_H" -o "$TMP_RES"
    q_code="$(grep -i '^X-Api-Status-Code:' "$TMP_H" | awk '{print $2}' | tr -d '\r' || true)"
    if [[ "$q_code" == "20000000" ]]; then
      break

Static analysis

No suspicious patterns detected.