openclaw-whisper-voice

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:12 AM UTC
• Version: 1.0.0

Overview

The skill appears to do local audio transcription as advertised, but its installer changes the user's Python and command-line environment using unpinned downloads and overwrites common tool launchers without safeguards.

Review this before installing on a gateway host. It is not showing malicious behavior, but it will modify your user-level Python environment and command path. Prefer running it in a dedicated virtual environment or disposable host, pinning and hashing dependencies, and checking whether ~/.local/bin/whisper or ~/.local/bin/ffmpeg already exist before running the installer.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_local_whisper.sh:10
• Finding: Unpinned Executable Dependencies and Unverified Mutable Bootstrap Script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_local_whisper.sh`, lines 10–29 **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and unverified remote code execution **Risk Level**: Medium ### Vulnerable Code ```bash curl -fsSL https://bootstrap.pypa.io/get-pip.py -o "$TMPDIR_RUN/get-pip.py" "$PYTHON_BIN" "$TMPDIR_RUN/get-pip.py" --user --break-system-packages fi "$PYTHON_BIN" -m pip install --user --break-system-packages \ imageio-ffmpeg \ more-itertools \ numba \ numpy \ tiktoken \ tqdm \ triton \ regex \ filelock \ sympy \ networkx \ fsspec "$PYTHON_BIN" -m pip install --user --break-system-packages \ --index-url https://download.pytorch.org/whl/cpu \ torch "$PYTHON_BIN" -m pip install --user --break-system-packages --no-deps openai-whisper ``` ### Technical Analysis The installer downloads `get-pip.py` from a mutable external URL and immediately executes it without checking a cryptographic digest or signature. Although HTTPS protects the connection in transit under normal conditions, it does not ensure that the downloaded content is the exact version previously reviewed by the project. The subsequent package installations do not pin package versions or verify distribution hashes. Package installation may execute package-controlled build or installation logic with the permissions of the user running the script. The effective code installed by this script can therefore change over time without any corresponding change to the audited repository. The package indexes and bootstrap domain shown in the script are legitimate sources, and the audited code contains no evidence that a malicious package was intentionally selected. This is therefore a supply-chain hardening defect rather than evidence of embedded malware. ### Attack Path 1. An attacker compromises an upstream package release, package-maintainer account, package index, bootstrap resource, or another relevant distr ...[truncated 1291 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed, exact version in a lock or requirements file. 2. Generate and record cryptographic hashes for every permitted distribution artifact, then install with `pip --require-hashes`. 3. Avoid downloading and executing `get-pip.py` dynamically. Prefer a trusted operating-system package, a pre-provisioned Python environment, or a vendored and reviewed bootstrap artifact. 4. If bootstrap downloading is unavoidable, pin a specific reviewed artifact and verify its SHA-256 digest or trusted signature before execution. 5. Install the toolchain inside a dedicated virtual environment rather than combining `--user` with `--break-system-packages`. 6. Pin the PyTorch CPU package and `openai-whisper` to reviewed versions, including hashes from their intended indexes. 7. Configure package-index allowlisting and ensure that each package is resolved only from its expected source. 8. Add automated dependency vulnerability scanning and a controlled process for reviewing and updating locked versions. ]]>

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- `base`: best default for chat voice notes
- `small` or larger: better accuracy, heavier CPU and RAM use

## Output rules

- Use `--stdout-only` for `tools.media.audio` so stdout is only transcript text.
- Use `--format txt|srt|vtt|json` for standalone file transcription.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs the agent/operator to run local shell scripts and configure a CLI command, but it declares no explicit tool scope or permissions boundary. That mismatch can cause the platform to grant or infer broader shell capability than reviewers expect, increasing the risk of unsafe command execution through this skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs unattended network retrieval and package installation, including downloading get-pip.py via curl and installing multiple Python packages into the user's environment with pip. This is risky because it changes the host system without explicit user acknowledgment, trusts remote package sources at install time, and could expose the user to supply-chain or environment-integrity issues if a package, index, or network path is compromised.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script creates or overwrites executable paths in ~/.local/bin, including a whisper wrapper and an ffmpeg symlink, without warning the user first. This can change command resolution in the user's shell, potentially shadow existing binaries or alter behavior of other tools that rely on whisper or ffmpeg, which is especially sensitive on a gateway host used for automation.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: In the default path, the script invokes whisper with `--output_dir .`, which creates output files in the caller's current working directory. Although this is part of transcription behavior, the file-writing side effect is not explicitly disclosed in a user-facing message, prompt, or comment within this script beyond the argument syntax.

Static analysis

No suspicious patterns detected.