ClawHub
Back to skill

Security audit

Openai Whisper Api

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform its stated job of sending user-selected audio to OpenAI for transcription and writing the result locally, with privacy and overwrite cautions but no artifact-backed deception or abuse.

Install only if you are comfortable sending the selected audio files to OpenAI for transcription. Avoid using it for confidential, regulated, or third-party recordings without authorization, and choose output paths carefully so transcripts do not overwrite important files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to send local audio files to OpenAI's external transcription API but does not clearly disclose that the audio contents leave the local environment. This can lead to unintended exposure of sensitive conversations, personally identifiable information, or regulated data if users assume transcription is local.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The script uploads the supplied audio file to a remote third-party API but provides no explicit notice, confirmation, or privacy warning at runtime. In contexts where users may process sensitive recordings, this can cause unintentional disclosure of confidential or regulated data despite the behavior being aligned with the skill's purpose.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.