Audio Quality Checker

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for audio quality checking, but users should know it uploads chosen audio files to SenseAudio and uses a SenseAudio API key.

Install this skill only if you are comfortable using SenseAudio's API for audio analysis. Keep the SENSEAUDIO_API_KEY private, use a limited or dedicated key if available, and only provide audio files that you intend to upload to the external service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing packages can introduce supply-chain risk if the package source or environment is not trusted.

Why it was flagged

The skill instructs the user to install an external Python package. This is common and purpose-aligned for making HTTP API calls, but the package version is not pinned.

Skill content

Install required Python packages:

```bash
pip install requests
```

Recommendation

Install from a trusted Python environment, consider pinning a known-good requests version, and avoid running setup commands in sensitive environments unnecessarily.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone with access to the environment variable could potentially use the SenseAudio API under the user's account or quota.

Why it was flagged

The skill uses a SenseAudio API key from the environment and sends it as a bearer token to the SenseAudio API. This is expected for the integration and is disclosed in the skill metadata.

Skill content

API_KEY = os.environ["SENSEAUDIO_API_KEY"]
...
headers = {"Authorization": f"Bearer {API_KEY}"}

Recommendation

Use a dedicated API key if possible, keep it private, rotate it if exposed, and confirm the key has only the permissions needed for audio analysis.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Audio files may contain private speech or background information and will leave the local environment when analyzed through this API.

Why it was flagged

The implementation uploads the selected audio file to an external SenseAudio API endpoint for analysis. This is central to the skill's purpose and is visible in the instructions.

Skill content

url = "https://api.senseaudio.cn/v1/audio/analysis"
...
files = {"file": open(audio_file, "rb")}
...
response = requests.post(url, headers=headers, files=files, data=data)

Recommendation

Only analyze audio files you are comfortable sending to SenseAudio, and review the provider's privacy, retention, and data handling terms before use.