Qwen ASR (C-based Offline)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:53 AM UTC
• Version: 1.0.0

Overview

The skill's transcription purpose is coherent, but it should be reviewed because it automatically builds and runs an unverified third-party ASR checkout from the user's home directory.

Install only if you are comfortable reviewing and pinning the qwen-asr checkout yourself. Prefer cloning a known commit, verifying the repo and binary before use, and treating submitted audio as sensitive because converted temporary audio may remain after failures.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/run.sh:51
• Finding: Unpinned External Repository Is Built and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.sh`, lines 51–63 **Vulnerability Type**: Unverified and unpinned third-party source dependency **Risk Level**: Medium ### Vulnerable Code ```bash if [[ ! -d "$REPO_DIR" ]]; then echo "Error: qwen-asr repo not found at $REPO_DIR. Run: git clone https://github.com/antirez/qwen-asr ~/.openclaw/workspace/qwen-asr" >&2 exit 1 fi if [[ ! -x "$BIN" ]]; then echo "Warning: qwen_asr binary not found. Building with 'make blas'..." >&2 cd "$REPO_DIR" make blas 2>&1 || { echo "Build failed."; exit 1; } fi ``` ### Technical Analysis The script instructs the user to clone the current default revision of an external GitHub repository without specifying an audited release, tag, or commit. It does not verify the repository revision, source integrity, release signature, or expected file checksums before running `make blas`. A Makefile is executable code for security purposes. Its recipes can invoke arbitrary commands with the privileges of the user running the skill. Consequently, a compromised upstream repository, an unexpected upstream change, or local modification of the repository can result in arbitrary commands being executed during the automatic build. The script also executes the resulting `qwen_asr` binary without verifying its provenance or integrity. This issue is limited to the dependency build and execution flow; the audited skill itself does not directly download or embed a malicious payload. ### Attack Path 1. An attacker compromises the referenced upstream repository, influences the revision obtained by the user, or tampers with the local repository at `~/.openclaw/workspace/qwen-asr`. 2. The attacker adds malicious commands to the Makefile or replaces source files used to produce `qwen_asr`. 3. The user follows the displayed unpinned `git clone` instruction. 4. When `qwen_asr` is absent or non-executable, the skill automatically enters the repository and runs `make blas`. 5. The ...[truncated 581 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific audited commit hash or immutable signed release rather than the repository's default branch. 2. Update the installation instruction to clone and check out that exact revision, for example: ```bash git clone https://github.com/antirez/qwen-asr.git "$REPO_DIR" git -C "$REPO_DIR" checkout --detach <audited-commit-hash> ``` 3. Before building, verify that `git -C "$REPO_DIR" rev-parse HEAD` exactly matches the approved commit. 4. Verify signed release tags where supported and publish expected checksums for source archives and compiled artifacts. 5. Refuse to build if the repository contains uncommitted modifications or an unexpected remote URL. 6. Prefer distributing a reproducibly built, checksum-verified binary or vendoring an audited dependency version. 7. Verify the final executable's checksum before every execution, especially when it resides in a user-writable workspace. 8. Build in a restricted environment with minimal filesystem and network access to reduce the impact of compromised build scripts. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/run.sh:77
• Finding: Sensitive Temporary Audio Persists After Processing Failures<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.sh`, lines 77–97 **Vulnerability Type**: Incomplete cleanup of sensitive temporary data **Risk Level**: Low ### Vulnerable Code ```bash TEMP_WAV=$(mktemp)/input.wav mkdir -p "$(dirname "$TEMP_WAV")" if [[ "${AUDIO##*.}" != "wav" ]]; then echo "Converting $AUDIO → 16kHz/mono/WAV..." >&2 else echo "Validating $AUDIO (16kHz/mono/WAV check)..." >&2 fi ffmpeg -y -i "$AUDIO" -ar 16000 -ac 1 -f wav -hide_banner -loglevel error "$TEMP_WAV" # ====== 推理 ====== ARGS=("-d" "$MODEL_DIR" "-i" "$TEMP_WAV") [[ -n "$THREADS" ]] && ARGS+=("-t" "$THREADS") echo "Running inference..." >&2 cd "$REPO_DIR" "$BIN" "${ARGS[@]}" rm -f "$TEMP_WAV" ``` ### Technical Analysis The temporary WAV is removed only after inference completes successfully. Because the script enables `set -e` near its beginning, a nonzero exit status from FFmpeg, `cd`, or the ASR executable terminates the script before the final `rm` command is reached. Interruptions and signals can produce the same result. The path is created under a `mktemp` directory, which normally provides protection against predictable-name and cross-user replacement attacks. The primary issue is therefore data retention rather than a conventional temporary-file race. In addition, the generated directory is never removed, even after successful processing. Audio supplied to a speech-recognition tool can contain confidential conversations, personal data, authentication phrases, or business information. Retaining a normalized copy unnecessarily increases the period during which that data may be recovered by later processes operating as the same account, backups, forensic tools, or a subsequent account compromise. ### Attack Path 1. A user submits sensitive audio for transcription. 2. FFmpeg successfully writes the normalized audio to the temporary WAV. 3. The ASR executable fails, the working-directory change fails, or the process is interrupted. 4. Due to `set -e ...[truncated 711 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a dedicated temporary directory and register cleanup immediately: ```bash TEMP_DIR=$(mktemp -d) TEMP_WAV="$TEMP_DIR/input.wav" cleanup() { rm -rf -- "$TEMP_DIR" } trap cleanup EXIT HUP INT TERM ``` 2. Register the trap before invoking FFmpeg so cleanup occurs on conversion errors, inference failures, normal exit, and common termination signals. 3. Remove the entire temporary directory rather than only the WAV file. 4. Apply a restrictive process umask such as `umask 077` before creating temporary data. 5. Avoid logging sensitive input paths unless operationally required. 6. Document that abnormal termination such as `SIGKILL` or system failure cannot be trapped, and consider placing temporary data on encrypted or memory-backed storage when processing highly sensitive recordings. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The title and description state that the skill performs '离线中文语音识别' and '进行中文语音转文字', which frames the skill as Chinese-only behavior. While line 37 mentions mixed Chinese/English support, the document does not offer a language choice or explain a justified policy reason for constraining usage to Chinese, which can violate language/locale choice expectations.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Linux (OpenBLAS)
```bash
# Ubuntu/Debian
sudo apt install libopenblas-dev

make blas BLAS=-lopenblas
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The file presents its primary natural-language description in Chinese, including the runner description and multiple user-facing messages, without indicating any language or locale option. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is documented and justified.

Static analysis

No suspicious patterns detected.