Security audit

Sense Audio

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward SenseAudio API integration guide; it involves sending media and API credentials to SenseAudio as expected, with no hidden execution or persistence.

Before installing or using this skill, understand that generated examples may send text, audio, video, prompts, identifiers, and API credentials to SenseAudio services. Use environment variables or secret management for API keys, avoid logging raw media or tokens, and add user consent, privacy notice, and retention controls when building production ASR or media-upload features.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (16)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The reference documents sending audio and API credentials to a third-party service but provides no user-facing notice about privacy, consent, or handling of potentially sensitive voice data. In the context of an integration guide, this omission can cause downstream implementations to transmit personal or confidential audio without adequate disclosure or policy controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The records section notes retention up to 7 days but does not clearly warn that transcription records are stored server-side and may remain accessible through query APIs. This creates a privacy and compliance risk because integrators may unknowingly build features that expose or rely on retained user speech data without disclosure or lifecycle controls.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/agent.md (reported line 15)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/agent.md (reported line 16)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/agent.md (reported line 17)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/agent.md (reported line 18)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/asr.md (reported line 16)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/asr.md (reported line 18)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/asr.md (reported line 19)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/tts.md (reported line 16)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/video.md (reported line 15)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/video.md (reported line 16)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/video.md (reported line 17)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/video.md (reported line 18)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/video.md (reported line 19)May include surrounding context.
md
## Endpoint Summary - Create video task: `POST https://api.senseaudio.cn/v1/video/create` - Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>` - Upload media: `POST https://api.senseaudio.cn/v1/video/upload` - Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file instructs use of an Authorization: Bearer <API_KEY> header but does not include any caution about safeguarding API keys or avoiding accidental disclosure in logs, examples, or shared code. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity, and credential handling falls into that scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.