ClawHub
Back to skill

Security audit

Speech-to-text, 3x faster than Whisper, remote FREE GPU

Security checks across malware telemetry and agentic risk

Overview

This skill transparently uploads selected audio or video to Modal for remote transcription and does not show hidden or unrelated behavior.

Install only if you are comfortable sending the selected recordings to Modal for remote GPU processing. Avoid sensitive or regulated media unless Modal is acceptable for that data, confirm directory selections carefully, download the results, and verify the slug before running the recursive cleanup command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes shell commands and writes files but declares no permissions, creating a mismatch between stated and actual capabilities. That can mislead users and host tooling about what the skill is allowed to do, reducing transparency and weakening policy enforcement around shell execution and filesystem modification.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The description omits that local audio/video files are uploaded to a remote Modal volume and processed on a remote GPU service, which is a material data-handling behavior. Users may provide sensitive recordings under the assumption of local-only processing, leading to unintended disclosure of private or regulated data to a third-party service.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The cleanup step performs a recursive deletion of the remote slug path without an explicit warning or confirmation, so a mistaken or reused slug could cause irreversible loss of uploaded inputs or generated outputs. Because the slug is user-provided or generated and acts as the directory key, deletion risk is amplified if naming collisions or operator error occur.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill persists transcripts and subtitle files to mounted storage without any visible consent, retention notice, or minimization controls. Because audio transcription frequently contains sensitive personal or business content, silently writing plaintext outputs to disk increases confidentiality and privacy risk if the storage is later accessed by other processes, operators, or users.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.