ClawHub
Back to skill

Security audit

Voice Picker

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward SenseAudio voice recommendation helper with an optional, visible audio preview step.

Install is reasonable for voice recommendations. Only provide SENSEAUDIO_API_KEY if you want audio previews, avoid using confidential text in previews, and delete generated preview.json or MP3 files when you no longer need them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs generating preview audio files locally and sending user-provided preview text to an external TTS API, but it does not warn the operator about either data egress or local file creation. This creates a real transparency and privacy issue because users may provide sensitive text for preview and the agent may persist artifacts on disk without clear consent.

External Transmission

Medium
Category
Data Exfiltration
Content
If the user wants to hear a sample, ask for a preview sentence (or use a default like "你好，欢迎体验 SenseAudio 语音服务。"), then call the TTS API:

```bash
curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
92% confidence
Finding
curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
If the user wants to hear a sample, ask for a preview sentence (or use a default like "你好，欢迎体验 SenseAudio 语音服务。"), then call the TTS API:

```bash
curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
92% confidence
Finding
https://api.senseaudio.cn/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.